diff options
Diffstat (limited to 'drivers/staging/most')
| -rw-r--r-- | drivers/staging/most/net/net.c | 10 | ||||
| -rw-r--r-- | drivers/staging/most/sound/sound.c | 5 |
2 files changed, 14 insertions, 1 deletions
diff --git a/drivers/staging/most/net/net.c b/drivers/staging/most/net/net.c index c8a64e209027..cc680c08c342 100644 --- a/drivers/staging/most/net/net.c +++ b/drivers/staging/most/net/net.c @@ -81,6 +81,11 @@ static int skb_to_mamac(const struct sk_buff *skb, struct mbo *mbo) unsigned int payload_len = skb->len - ETH_HLEN; unsigned int mdp_len = payload_len + MDP_HDR_LEN; + if (mdp_len < skb->len) { + pr_err("drop: too large packet! (%u)\n", skb->len); + return -EINVAL; + } + if (mbo->buffer_length < mdp_len) { pr_err("drop: too small buffer! (%d for %d)\n", mbo->buffer_length, mdp_len); @@ -128,6 +133,11 @@ static int skb_to_mep(const struct sk_buff *skb, struct mbo *mbo) u8 *buff = mbo->virt_address; unsigned int mep_len = skb->len + MEP_HDR_LEN; + if (mep_len < skb->len) { + pr_err("drop: too large packet! (%u)\n", skb->len); + return -EINVAL; + } + if (mbo->buffer_length < mep_len) { pr_err("drop: too small buffer! (%d for %d)\n", mbo->buffer_length, mep_len); diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c index 342f390d68b3..79817061fcfa 100644 --- a/drivers/staging/most/sound/sound.c +++ b/drivers/staging/most/sound/sound.c @@ -802,8 +802,11 @@ static int __init audio_init(void) if (ret) pr_err("Failed to register %s\n", comp.name); ret = most_register_configfs_subsys(&comp); - if (ret) + if (ret) { pr_err("Failed to register %s configfs subsys\n", comp.name); + most_deregister_component(&comp); + } + return ret; } |