summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--drivers/firewire/fw-cdev.c27
1 files changed, 25 insertions, 2 deletions
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index 75bbd66f852e..a320ab48edd6 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -398,6 +398,7 @@ static int ioctl_send_request(struct client *client, void *buffer)
struct fw_device *device = client->device;
struct fw_cdev_send_request *request = buffer;
struct response *response;
+ int ret;
/* What is the biggest size we'll accept, really? */
if (request->length > 4096)
@@ -414,8 +415,26 @@ static int ioctl_send_request(struct client *client, void *buffer)
if (request->data &&
copy_from_user(response->response.data,
u64_to_uptr(request->data), request->length)) {
- kfree(response);
- return -EFAULT;
+ ret = -EFAULT;
+ goto err;
+ }
+
+ switch (request->tcode) {
+ case TCODE_WRITE_QUADLET_REQUEST:
+ case TCODE_WRITE_BLOCK_REQUEST:
+ case TCODE_READ_QUADLET_REQUEST:
+ case TCODE_READ_BLOCK_REQUEST:
+ case TCODE_LOCK_MASK_SWAP:
+ case TCODE_LOCK_COMPARE_SWAP:
+ case TCODE_LOCK_FETCH_ADD:
+ case TCODE_LOCK_LITTLE_ADD:
+ case TCODE_LOCK_BOUNDED_ADD:
+ case TCODE_LOCK_WRAP_ADD:
+ case TCODE_LOCK_VENDOR_DEPENDENT:
+ break;
+ default:
+ ret = -EINVAL;
+ goto err;
}
response->resource.release = release_transaction;
@@ -434,6 +453,10 @@ static int ioctl_send_request(struct client *client, void *buffer)
return sizeof(request) + request->length;
else
return sizeof(request);
+ err:
+ kfree(response);
+
+ return ret;
}
struct address_handler {