Merge tag 'media/v5.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - remove the deprecated Zoran driver from staging

 - new I2C driver: ST MIPID02 CSI-2 camera bridge

 - new platform driver: Amlogic Meson AO CEC G12A Controller

 - add support for USB audio via the media controller

 - au0828 driver is now supported via the media controller on both on
   media and on usbaudio

 - new kernel test for the media device allocator

 - add support for stateless decoder at vicodec driver

 - lots of other driver improvements fixes and cleanups

* tag 'media/v5.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (218 commits)
  media: dt-bindings: aspeed-video: Add missing memory-region property
  media: platform: Aspeed: Make reserved memory optional
  media: platform: Aspeed: Remove use of reset line
  media: stm32-dcmi: return appropriate error codes during probe
  media: vsp1: Add support for missing 16-bit RGB555 formats
  media: vsp1: Add support for missing 16-bit RGB444 formats
  media: vsp1: Add support for missing 32-bit RGB formats
  media: v4l: Add definitions for missing 16-bit RGB555 formats
  media: v4l: Add definitions for missing 16-bit RGB4444 formats
  media: v4l: Add definitions for missing 32-bit RGB formats
  media: zoran: remove deprecated driver
  media: MAINTAINERS: Update AO CEC with ao-cec-g12a driver
  media: platform: meson: Add Amlogic Meson G12A AO CEC Controller driver
  media: dt-bindings: media: meson-ao-cec: Add G12A AO-CEC-B Compatible
  media: cros-ec-cec: decrement HDMI device refcount
  media: seco-cec: decrement HDMI device refcount
  media: tegra_cec: use new cec_notifier_parse_hdmi_phandle helper
  media: stih_cec: use new cec_notifier_parse_hdmi_phandle helper
  media: s5p_cec: use new cec_notifier_parse_hdmi_phandle helper
  media: meson: ao-cec: use new cec_notifier_parse_hdmi_phandle helper
  ...

1 files changed, 9 insertions, 5 deletions

diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index 3c8987af3772..053d51a5890a 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload,
 		return -EIO;
 	}
 	/* Send response data to caller */
-	if (response != NULL && response_len != NULL && evt_hdr->dlen) {
+	if (response != NULL && response_len != NULL && evt_hdr->dlen &&
+	    evt_hdr->dlen <= payload_len) {
 		/* Skip header info and copy only response data */
 		skb_pull(skb, sizeof(struct fm_event_msg_hdr));
 		memcpy(response, skb->data, evt_hdr->dlen);
@@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
 		return;
 
 	fm_evt_hdr = (void *)skb->data;
+	if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag))
+		return;
 
 	/* Skip header info and copy only response data */
 	skb_pull(skb, sizeof(struct fm_event_msg_hdr));
@@ -1268,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
 
 		switch (action->type) {
 		case ACTION_SEND_COMMAND:	/* Send */
-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
-						action->size, NULL, NULL))
+			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
+					   action->size, NULL, NULL);
+			if (ret)
 				goto rel_fw;
 
 			cmd_cnt++;
@@ -1308,7 +1312,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev)
 static int fm_power_up(struct fmdev *fmdev, u8 mode)
 {
 	u16 payload;
-	__be16 asic_id, asic_ver;
+	__be16 asic_id = 0, asic_ver = 0;
 	int resp_len, ret;
 	u8 fw_name[50];
 
@@ -1520,7 +1524,7 @@ int fmc_prepare(struct fmdev *fmdev)
 		}
 
 		ret = 0;
-	} else if (ret == -1) {
+	} else if (ret < 0) {
 		fmerr("st_register failed %d\n", ret);
 		return -EAGAIN;
 	}