diff options
| author | Clemens Ladisch <clemens@ladisch.de> | 2010-03-31 16:26:39 +0200 |
|---|---|---|
| committer | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2010-04-10 16:51:13 +0200 |
| commit | 4ba1d9c0c22947a9207029e7184733252e6135f1 (patch) | |
| tree | 7801ca5b28bfb50a1992483ebbf86b46471b05dc | |
| parent | fe43d6d9cf59d8f8cbfdcde2018de13ffd1285c7 (diff) | |
| download | op-kernel-dev-4ba1d9c0c22947a9207029e7184733252e6135f1.zip op-kernel-dev-4ba1d9c0c22947a9207029e7184733252e6135f1.tar.gz | |
firewire: cdev: disallow receive packets without header
In receive contexts, reject packets with header_length==0. This would
be an instruction to queue zero packets which would not make sense.
This prevents a division by zero in the OHCI driver.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
| -rw-r--r-- | drivers/firewire/core-cdev.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c index 8be720b..bbb8160 100644 --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -968,7 +968,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg) if (ctx->header_size == 0) { if (u.packet.header_length > 0) return -EINVAL; - } else if (u.packet.header_length % ctx->header_size != 0) { + } else if (u.packet.header_length == 0 || + u.packet.header_length % ctx->header_size != 0) { return -EINVAL; } header_length = 0; |
