Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (247 commits)
  [media] gspca - sunplus: Fix some warnings and simplify code
  [media] gspca: Fix some warnings tied to 'no debug'
  [media] gspca: Unset debug by default
  [media] gspca - cpia1: Remove a bad conditional compilation instruction
  [media] gspca - main: Remove USB traces
  [media] gspca - main: Version change to 2.13
  [media] gspca - stk014 / t613: Accept the index 0 in querymenu
  [media] gspca - kinect: Remove __devinitdata
  [media] gspca - cpia1: Fix some warnings
  [media] video/Kconfig: Fix mis-classified devices
  [media] support for medion dvb stick 1660:1921
  [media] tm6000: fix uninitialized field, change prink to dprintk
  [media] cx231xx: Add support for Iconbit U100
  [media] saa7134 add new TV cards
  [media] Use a more consistent value for RC repeat period
  [media] cx18: Move spinlock and vb_type initialisation into stream_init
  [media] tm6000: remove tm6010 sif audio start and stop
  [media] tm6000: remove unused exports
  [media] tm6000: add pts logging
  [media] tm6000: change from ioctl to unlocked_ioctl
  ...

1 files changed, 16 insertions, 6 deletions

diff --git a/drivers/media/dvb/dvb-usb/au6610.c b/drivers/media/dvb/dvb-usb/au6610.c
index eb34cc3894e..2351077ff2b 100644
--- a/drivers/media/dvb/dvb-usb/au6610.c
+++ b/drivers/media/dvb/dvb-usb/au6610.c
@@ -33,8 +33,16 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
 {
 	int ret;
 	u16 index;
-	u8 usb_buf[6]; /* enough for all known requests,
-			  read returns 5 and write 6 bytes */
+	u8 *usb_buf;
+
+	/*
+	 * allocate enough for all known requests,
+	 * read returns 5 and write 6 bytes
+	 */
+	usb_buf = kmalloc(6, GFP_KERNEL);
+	if (!usb_buf)
+		return -ENOMEM;
+
 	switch (wlen) {
 	case 1:
 		index = wbuf[0] << 8;
@@ -45,14 +53,15 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
 		break;
 	default:
 		warn("wlen = %x, aborting.", wlen);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto error;
 	}
 
 	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), operation,
 			      USB_TYPE_VENDOR|USB_DIR_IN, addr << 1, index,
-			      usb_buf, sizeof(usb_buf), AU6610_USB_TIMEOUT);
+			      usb_buf, 6, AU6610_USB_TIMEOUT);
 	if (ret < 0)
-		return ret;
+		goto error;
 
 	switch (operation) {
 	case AU6610_REQ_I2C_READ:
@@ -60,7 +69,8 @@ static int au6610_usb_msg(struct dvb_usb_device *d, u8 operation, u8 addr,
 		/* requested value is always 5th byte in buffer */
 		rbuf[0] = usb_buf[4];
 	}
-
+error:
+	kfree(usb_buf);
 	return ret;
 }