Merge tag 'media/v4.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - Documentation improvements: conversion of all non-DocBook documents
   to Sphinx and lots of fixes to the uAPI media book

 - New PCI driver for Techwell TW5864 media grabber boards

 - New SoC driver for ATMEL Image Sensor Controller

 - Removal of some obsolete SoC drivers (s5p-tv driver and soc_camera
   drivers)

 - Addition of ST CEC driver

 - Lots of drivers fixes, improvements and additions

* tag 'media/v4.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (464 commits)
  [media] ttusb_dec: avoid the risk of go past buffer
  [media] cx23885: Fix some smatch warnings
  [media] si2165: switch to regmap
  [media] si2165: use i2c_client->dev instead of i2c_adapter->dev for logging
  [media] si2165: Remove legacy attach
  [media] cx231xx: attach si2165 driver via i2c_client
  [media] cx231xx: Prepare for attaching new style i2c_client DVB demod drivers
  [media] cx23885: attach si2165 driver via i2c_client
  [media] si2165: support i2c_client attach
  [media] si2165: avoid division by zero
  [media] rcar-vin: add R-Car gen2 fallback compatibility string
  [media] lgdt3306a: remove 20*50 msec unnecessary timeout
  [media] cx25821: Remove deprecated create_singlethread_workqueue
  [media] cx25821: Drop Freeing of Workqueue
  [media] cxd2841er: force 8MHz bandwidth for DVB-C if specified bw not supported
  [media] redrat3: hardware-specific parameters
  [media] redrat3: remove hw_timeout member
  [media] cxd2841er: BER and SNR reading for ISDB-T
  [media] dvb-usb: avoid link error with dib3000m{b,c|
  [media] dvb-usb: split out common parts of dibusb
  ...

1 files changed, 6 insertions, 22 deletions

diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index be99c8dbc5f8..01511e5a5566 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -1969,17 +1969,9 @@ static int dvb_frontend_ioctl_properties(struct file *file,
 		if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
-		tvp = kmalloc(tvps->num * sizeof(struct dtv_property), GFP_KERNEL);
-		if (!tvp) {
-			err = -ENOMEM;
-			goto out;
-		}
-
-		if (copy_from_user(tvp, (void __user *)tvps->props,
-				   tvps->num * sizeof(struct dtv_property))) {
-			err = -EFAULT;
-			goto out;
-		}
+		tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp));
+		if (IS_ERR(tvp))
+			return PTR_ERR(tvp);
 
 		for (i = 0; i < tvps->num; i++) {
 			err = dtv_property_process_set(fe, tvp + i, file);
@@ -2002,17 +1994,9 @@ static int dvb_frontend_ioctl_properties(struct file *file,
 		if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
-		tvp = kmalloc(tvps->num * sizeof(struct dtv_property), GFP_KERNEL);
-		if (!tvp) {
-			err = -ENOMEM;
-			goto out;
-		}
-
-		if (copy_from_user(tvp, (void __user *)tvps->props,
-				   tvps->num * sizeof(struct dtv_property))) {
-			err = -EFAULT;
-			goto out;
-		}
+		tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp));
+		if (IS_ERR(tvp))
+			return PTR_ERR(tvp);
 
 		/*
 		 * Let's use our own copy of property cache, in order to