From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Brownell Subject: [patch 2.6.27-rc6] spi_mpc83xx: reject invalid transfer sizes Date: Wed, 10 Sep 2008 17:13:21 -0700 Message-ID: <200809101713.21496.david-b@pacbell.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: spi-devel-general-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, Joakim Tjernlund To: Andrew Morton Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: spi-devel-general-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: spi-devel-general-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: linux-spi.vger.kernel.org From: Peter Korsgaard Error out on transfer length != multiple of bytes per word. Signed-off-by: Peter Korsgaard Acked-by: Joakim Tjernlund Signed-off-by: David Brownell --- drivers/spi/spi_mpc83xx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/drivers/spi/spi_mpc83xx.c +++ b/drivers/spi/spi_mpc83xx.c @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_d if (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; - if (bits_per_word > 8) + if (bits_per_word > 8) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; - if (bits_per_word > 16) + } + if (bits_per_word > 16) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; + } mpc83xx_spi->count = len; + INIT_COMPLETION(mpc83xx_spi->done); /* enable rx ints */ ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/