X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=drivers%2Fspi%2Fspi_mpc83xx.c;fp=drivers%2Fspi%2Fspi_mpc83xx.c;h=ac0e3e4b3c543e480028d90829c7f5606b7fde71;hb=aa77d96ba94326db4f50d2aa36602824dd03286a;hp=ab7ee445d8b29bdd8f1a1fd3db4ab955d2a3cf72;hpb=53604dbe1371c3c4458c2d741adbd8cfd8fe8e79;p=linux-2.6

diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index ab7ee445d8..ac0e3e4b3c 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
 	if (t->bits_per_word)
 		bits_per_word = t->bits_per_word;
 	len = t->len;
-	if (bits_per_word > 8)
+	if (bits_per_word > 8) {
+		/* invalid length? */
+		if (len & 1)
+			return -EINVAL;
 		len /= 2;
-	if (bits_per_word > 16)
+	}
+	if (bits_per_word > 16) {
+		/* invalid length? */
+		if (len & 1)
+			return -EINVAL;
 		len /= 2;
+	}
 	mpc83xx_spi->count = len;
+
 	INIT_COMPLETION(mpc83xx_spi->done);
 
 	/* enable rx ints */