Commit 5f1141eb352ea79d849920039503e40dd623fffa
Exists in
master
and in
7 other branches
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: handle receive packets with a data length of zero
Showing 1 changed file Side-by-side Diff
drivers/firewire/ohci.c
... | ... | @@ -2218,6 +2218,13 @@ |
2218 | 2218 | page = payload >> PAGE_SHIFT; |
2219 | 2219 | offset = payload & ~PAGE_MASK; |
2220 | 2220 | rest = p->payload_length; |
2221 | + /* | |
2222 | + * The controllers I've tested have not worked correctly when | |
2223 | + * second_req_count is zero. Rather than do something we know won't | |
2224 | + * work, return an error | |
2225 | + */ | |
2226 | + if (rest == 0) | |
2227 | + return -EINVAL; | |
2221 | 2228 | |
2222 | 2229 | /* FIXME: make packet-per-buffer/dual-buffer a context option */ |
2223 | 2230 | while (rest > 0) { |
... | ... | @@ -2271,7 +2278,7 @@ |
2271 | 2278 | unsigned long payload) |
2272 | 2279 | { |
2273 | 2280 | struct iso_context *ctx = container_of(base, struct iso_context, base); |
2274 | - struct descriptor *d = NULL, *pd = NULL; | |
2281 | + struct descriptor *d, *pd; | |
2275 | 2282 | struct fw_iso_packet *p = packet; |
2276 | 2283 | dma_addr_t d_bus, page_bus; |
2277 | 2284 | u32 z, header_z, rest; |
2278 | 2285 | |
... | ... | @@ -2309,8 +2316,9 @@ |
2309 | 2316 | d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d))); |
2310 | 2317 | |
2311 | 2318 | rest = payload_per_buffer; |
2319 | + pd = d; | |
2312 | 2320 | for (j = 1; j < z; j++) { |
2313 | - pd = d + j; | |
2321 | + pd++; | |
2314 | 2322 | pd->control = cpu_to_le16(DESCRIPTOR_STATUS | |
2315 | 2323 | DESCRIPTOR_INPUT_MORE); |
2316 | 2324 |