update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/media/usb/dvb-usb-v2/af9035.c
..
..
@@ -269,6 +269,7 @@
269
269
 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
270
270
 	struct state *state = d_to_priv(d);
271
271
 	int ret;
272
+	u32 reg;
272
273
 
273
274
 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
274
275
 		return -EAGAIN;
..
..
@@ -321,8 +322,10 @@
321
322
 			ret = -EOPNOTSUPP;
322
323
 		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
323
324
 			   (msg[0].addr == state->af9033_i2c_addr[1])) {
325
+			if (msg[0].len < 3 || msg[1].len < 1)
326
+				return -EOPNOTSUPP;
324
327
 			/* demod access via firmware interface */
325
-			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
328
+			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
326
329
 					msg[0].buf[2];
327
330
 
328
331
 			if (msg[0].addr == state->af9033_i2c_addr[1])
..
..
@@ -380,17 +383,16 @@
380
383
 			ret = -EOPNOTSUPP;
381
384
 		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
382
385
 			   (msg[0].addr == state->af9033_i2c_addr[1])) {
386
+			if (msg[0].len < 3)
387
+				return -EOPNOTSUPP;
383
388
 			/* demod access via firmware interface */
384
-			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
389
+			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
385
390
 					msg[0].buf[2];
386
391
 
387
392
 			if (msg[0].addr == state->af9033_i2c_addr[1])
388
393
 				reg |= 0x100000;
389
394
 
390
-			ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,
391
-							         &msg[0].buf[3],
392
-							         msg[0].len - 3)
393
-					        : -EOPNOTSUPP;
395
+			ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3);
394
396
 		} else {
395
397
 			/* I2C write */
396
398
 			u8 buf[MAX_XFER_SIZE];