path: root/drivers
diff options
authorClemens Ladisch <clemens@ladisch.de>2010-03-31 16:26:46 +0200
committerStefan Richter <stefanr@s5r6.in-berlin.de>2010-04-10 16:51:13 +0200
commit385ab5bcd4be586dffdba550b310308d89eade71 (patch)
tree76b56fc42e4f11aeb4cfdcc6e98b16220927ca04 /drivers
parent4ba1d9c0c22947a9207029e7184733252e6135f1 (diff)
firewire: cdev: require quadlet-aligned headers for transmit packets
The definition of struct fw_cdev_iso_packet seems to imply that the header_length must be quadlet-aligned, and in fact, specifying an unaligned header has never really worked when using multiple packet structures, because the position of the next control word is computed by rounding the header_length _down_, so the last one to three bytes of the header would overlap the next control word. To avoid this problem, check that the header length is properly aligned. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers')
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index bbb8160e2c9..5eba9e0f876 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -959,6 +959,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
u.packet.header_length = GET_HEADER_LENGTH(control);
if (ctx->type == FW_ISO_CONTEXT_TRANSMIT) {
+ if (u.packet.header_length % 4 != 0)
+ return -EINVAL;
header_length = u.packet.header_length;
} else {