spi_mpc83xx: reject invalid transfer sizes

[linux-2.6] / drivers / spi / spi_mpc83xx.c

diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index ab7ee445d8b29bdd8f1a1fd3db4ab955d2a3cf72..ac0e3e4b3c543e480028d90829c7f5606b7fde71 100644 (file)
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
        if (t->bits_per_word)
                bits_per_word = t->bits_per_word;
        len = t->len;
-       if (bits_per_word > 8)
+       if (bits_per_word > 8) {
+               /* invalid length? */
+               if (len & 1)
+                       return -EINVAL;
                len /= 2;
-       if (bits_per_word > 16)
+       }
+       if (bits_per_word > 16) {
+               /* invalid length? */
+               if (len & 1)
+                       return -EINVAL;
                len /= 2;
+       }
        mpc83xx_spi->count = len;
+
        INIT_COMPLETION(mpc83xx_spi->done);
 
        /* enable rx ints */