Merge tag 'media/v4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab...

Pull media fixes from Mauro Carvalho Chehab:
 "A series of fixup patches meant to fix the usage of DMA on stack, plus
  one warning fixup"

* tag 'media/v4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (32 commits)
  [media] radio-bcm2048: don't ignore errors
  [media] pctv452e: fix semicolon.cocci warnings
  [media] flexcop-usb: don't use stack for DMA
  [media] stk-webcam: don't use stack for DMA
  [media] s2255drv: don't use stack for DMA
  [media] cpia2_usb: don't use stack for DMA
  [media] digitv: handle error code on RC query
  [media] dw2102: return error if su3000_power_ctrl() fails
  [media] nova-t-usb2: handle error code on RC query
  [media] technisat-usb2: use DMA buffers for I2C transfers
  [media] pctv452e: don't call BUG_ON() on non-fatal error
  [media] pctv452e: don't do DMA on stack
  [media] nova-t-usb2: don't do DMA on stack
  [media] gp8psk: don't go past the buffer size
  [media] gp8psk: don't do DMA on stack
  [media] dtv5100: don't do DMA on stack
  [media] dtt200u: handle USB control message errors
  [media] dtt200u: don't do DMA on stack
  [media] dtt200u-fe: handle errors on USB control messages
  [media] dtt200u-fe: don't do DMA on stack
  ...

diff --combined drivers/media/usb/dvb-usb/dibusb-common.c
index 18ed3bfbb5e2a95f5127b41d0e1f15cce01b1f07,b0fd9a609352925063e32f7baa6f54c08e0c9866..de3ee2547479428cd1c14347db5332ea1090c60d
--- 1/drivers/media/usb/dvb-usb/dibusb-common.c
--- 2/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@@ -9,6 -9,7 +9,6 @@@
   * see Documentation/dvb/README.dvb-usb for more information
   */
  
 -#include <linux/kconfig.h>
  #include "dibusb.h"
  
  /* Max transfer size done by I2C transfer functions */
@@@ -62,72 -63,117 +62,117 @@@ EXPORT_SYMBOL(dibusb_pid_filter_ctrl)
  
  int dibusb_power_ctrl(struct dvb_usb_device *d, int onoff)
  {
-       u8 b[3];
+       u8 *b;
        int ret;
+ 
+       b = kmalloc(3, GFP_KERNEL);
+       if (!b)
+               return -ENOMEM;
+ 
        b[0] = DIBUSB_REQ_SET_IOCTL;
        b[1] = DIBUSB_IOCTL_CMD_POWER_MODE;
        b[2] = onoff ? DIBUSB_IOCTL_POWER_WAKEUP : DIBUSB_IOCTL_POWER_SLEEP;
-       ret = dvb_usb_generic_write(d,b,3);
+ 
+       ret = dvb_usb_generic_write(d, b, 3);
+ 
+       kfree(b);
+ 
        msleep(10);
+ 
        return ret;
  }
  EXPORT_SYMBOL(dibusb_power_ctrl);
  
  int dibusb2_0_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
  {
-       u8 b[3] = { 0 };
        int ret;
+       u8 *b;
+ 
+       b = kmalloc(3, GFP_KERNEL);
+       if (!b)
+               return -ENOMEM;
  
        if ((ret = dibusb_streaming_ctrl(adap,onoff)) < 0)
-               return ret;
+               goto ret;
  
        if (onoff) {
                b[0] = DIBUSB_REQ_SET_STREAMING_MODE;
                b[1] = 0x00;
-               if ((ret = dvb_usb_generic_write(adap->dev,b,2)) < 0)
-                       return ret;
+               ret = dvb_usb_generic_write(adap->dev, b, 2);
+               if (ret  < 0)
+                       goto ret;
        }
  
        b[0] = DIBUSB_REQ_SET_IOCTL;
        b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
-       return dvb_usb_generic_write(adap->dev,b,3);
+       ret = dvb_usb_generic_write(adap->dev, b, 3);
+ 
+ ret:
+       kfree(b);
+       return ret;
  }
  EXPORT_SYMBOL(dibusb2_0_streaming_ctrl);
  
  int dibusb2_0_power_ctrl(struct dvb_usb_device *d, int onoff)
  {
-       if (onoff) {
-               u8 b[3] = { DIBUSB_REQ_SET_IOCTL, DIBUSB_IOCTL_CMD_POWER_MODE, DIBUSB_IOCTL_POWER_WAKEUP };
-               return dvb_usb_generic_write(d,b,3);
-       } else
+       u8 *b;
+       int ret;
+ 
+       if (!onoff)
                return 0;
+ 
+       b = kmalloc(3, GFP_KERNEL);
+       if (!b)
+               return -ENOMEM;
+ 
+       b[0] = DIBUSB_REQ_SET_IOCTL;
+       b[1] = DIBUSB_IOCTL_CMD_POWER_MODE;
+       b[2] = DIBUSB_IOCTL_POWER_WAKEUP;
+ 
+       ret = dvb_usb_generic_write(d, b, 3);
+ 
+       kfree(b);
+ 
+       return ret;
  }
  EXPORT_SYMBOL(dibusb2_0_power_ctrl);
  
  static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr,
                          u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
  {
-       u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
+       u8 *sndbuf;
+       int ret, wo, len;
+ 
        /* write only ? */
-       int wo = (rbuf == NULL || rlen == 0),
-               len = 2 + wlen + (wo ? 0 : 2);
+       wo = (rbuf == NULL || rlen == 0);
+ 
+       len = 2 + wlen + (wo ? 0 : 2);
+ 
+       sndbuf = kmalloc(MAX_XFER_SIZE, GFP_KERNEL);
+       if (!sndbuf)
+               return -ENOMEM;
  
-       if (4 + wlen > sizeof(sndbuf)) {
+       if (4 + wlen > MAX_XFER_SIZE) {
                warn("i2c wr: len=%d is too big!\n", wlen);
-               return -EOPNOTSUPP;
+               ret = -EOPNOTSUPP;
+               goto ret;
        }
  
        sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ;
        sndbuf[1] = (addr << 1) | (wo ? 0 : 1);
  
-       memcpy(&sndbuf[2],wbuf,wlen);
+       memcpy(&sndbuf[2], wbuf, wlen);
  
        if (!wo) {
-               sndbuf[wlen+2] = (rlen >> 8) & 0xff;
-               sndbuf[wlen+3] = rlen & 0xff;
+               sndbuf[wlen + 2] = (rlen >> 8) & 0xff;
+               sndbuf[wlen + 3] = rlen & 0xff;
        }
  
-       return dvb_usb_generic_rw(d,sndbuf,len,rbuf,rlen,0);
+       ret = dvb_usb_generic_rw(d, sndbuf, len, rbuf, rlen, 0);
+ 
+ ret:
+       kfree(sndbuf);
+       return ret;
  }
  
  /*
@@@ -319,11 -365,27 +364,27 @@@ EXPORT_SYMBOL(rc_map_dibusb_table)
  
  int dibusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
  {
-       u8 key[5],cmd = DIBUSB_REQ_POLL_REMOTE;
-       dvb_usb_generic_rw(d,&cmd,1,key,5,0);
-       dvb_usb_nec_rc_key_to_event(d,key,event,state);
-       if (key[0] != 0)
-               deb_info("key: %*ph\n", 5, key);
-       return 0;
+       u8 *buf;
+       int ret;
+ 
+       buf = kmalloc(5, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+ 
+       buf[0] = DIBUSB_REQ_POLL_REMOTE;
+ 
+       ret = dvb_usb_generic_rw(d, buf, 1, buf, 5, 0);
+       if (ret < 0)
+               goto ret;
+ 
+       dvb_usb_nec_rc_key_to_event(d, buf, event, state);
+ 
+       if (buf[0] != 0)
+               deb_info("key: %*ph\n", 5, buf);
+ 
+       kfree(buf);
+ 
+ ret:
+       return ret;
  }
  EXPORT_SYMBOL(dibusb_rc_query);

diff --combined drivers/staging/media/bcm2048/radio-bcm2048.c
index ea15cc6380970e159addcf91ce18c431b1cb1ef0,0f088405e186418930fdc91925ce5ff223563b6a..4d9bd02ede4700c8a89460ed68b0ce66898d3c26
--- 1/drivers/staging/media/bcm2048/radio-bcm2048.c
--- 2/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@@ -482,9 -482,13 +482,11 @@@ static int bcm2048_set_rds_no_lock(stru
                                           flags);
                memset(&bdev->rds_info, 0, sizeof(bdev->rds_info));
        }
+       if (err)
+               return err;
  
 -      err = bcm2048_send_command(bdev, BCM2048_I2C_FM_RDS_SYSTEM,
 -                                 bdev->cache_fm_rds_system);
 -
 -      return err;
 +      return bcm2048_send_command(bdev, BCM2048_I2C_FM_RDS_SYSTEM,
 +                                  bdev->cache_fm_rds_system);
  }
  
  static int bcm2048_get_rds_no_lock(struct bcm2048_device *bdev)
@@@ -1832,7 -1836,9 +1834,7 @@@ static int bcm2048_deinit(struct bcm204
        if (err < 0)
                return err;
  
 -      err = bcm2048_set_power_state(bdev, BCM2048_POWER_OFF);
 -
 -      return err;
 +      return bcm2048_set_power_state(bdev, BCM2048_POWER_OFF);
  }
  
  /*
@@@ -1991,7 -1997,9 +1993,7 @@@ static ssize_t bcm2048_##prop##_read(st
                                                                        \
        value = bcm2048_get_##prop(bdev);                               \
                                                                        \
 -      value = sprintf(buf, mask "\n", value);                         \
 -                                                                      \
 -      return value;                                                   \
 +      return sprintf(buf, mask "\n", value);                          \
  }
  
  #define DEFINE_SYSFS_PROPERTY(prop, signal, size, mask, check)                \