aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorClemens Ladisch <clemens@ladisch.de>2010-03-31 16:26:39 +0200
committerStefan Richter <stefanr@s5r6.in-berlin.de>2010-04-10 16:51:13 +0200
commit4ba1d9c0c22947a9207029e7184733252e6135f1 (patch)
tree7801ca5b28bfb50a1992483ebbf86b46471b05dc /drivers
parentfe43d6d9cf59d8f8cbfdcde2018de13ffd1285c7 (diff)
downloadmrst-s0i3-test-4ba1d9c0c22947a9207029e7184733252e6135f1.tar.gz
mrst-s0i3-test-4ba1d9c0c22947a9207029e7184733252e6135f1.tar.xz
mrst-s0i3-test-4ba1d9c0c22947a9207029e7184733252e6135f1.zip
firewire: cdev: disallow receive packets without header
In receive contexts, reject packets with header_length==0. This would be an instruction to queue zero packets which would not make sense. This prevents a division by zero in the OHCI driver. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/firewire/core-cdev.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 8be720b278b..bbb8160e2c9 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -968,7 +968,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
if (ctx->header_size == 0) {
if (u.packet.header_length > 0)
return -EINVAL;
- } else if (u.packet.header_length % ctx->header_size != 0) {
+ } else if (u.packet.header_length == 0 ||
+ u.packet.header_length % ctx->header_size != 0) {
return -EINVAL;
}
header_length = 0;