mempolicy: ERR_PTR dereference in mpol_shared_policy_init()

[safe/jmp/linux-2.6] / drivers / firewire / core-card.c

diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index f581307..5045156 100644 (file)
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -38,7 +38,7 @@
 
 #include "core.h"
 
-static int __compute_block_crc(__be32 *block)
+int fw_compute_block_crc(__be32 *block)
 {
        int length;
        u16 crc;
@@ -50,19 +50,6 @@ static int __compute_block_crc(__be32 *block)
        return length;
 }
 
-int fw_compute_block_crc(u32 *block)
-{
-       __be32 be32_block[256];
-       int i, length;
-
-       length = (*block >> 16) & 0xff;
-       for (i = 0; i < length; i++)
-               be32_block[i] = cpu_to_be32(block[i + 1]);
-       *block |= crc_itu_t(0, (u8 *) be32_block, length * 4);
-
-       return length;
-}
-
 static DEFINE_MUTEX(card_mutex);
 static LIST_HEAD(card_list);
 
@@ -70,6 +57,8 @@ static LIST_HEAD(descriptor_list);
 static int descriptor_count;
 
 static __be32 tmp_config_rom[256];
+/* ROM header, bus info block, root dir header, capabilities = 7 quadlets */
+static size_t config_rom_length = 1 + 4 + 1 + 1;
 
 #define BIB_CRC(v)             ((v) <<  0)
 #define BIB_CRC_LENGTH(v)      ((v) << 16)
@@ -86,7 +75,7 @@ static __be32 tmp_config_rom[256];
 #define BIB_CMC                        ((1) << 30)
 #define BIB_IMC                        ((1) << 31)
 
-static size_t generate_config_rom(struct fw_card *card, __be32 *config_rom)
+static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 {
        struct fw_descriptor *desc;
        int i, j, k, length;
@@ -141,25 +130,32 @@ static size_t generate_config_rom(struct fw_card *card, __be32 *config_rom)
         * the bus info block, which is always the case for this
         * implementation. */
        for (i = 0; i < j; i += length + 1)
-               length = __compute_block_crc(config_rom + i);
+               length = fw_compute_block_crc(config_rom + i);
 
-       return j;
+       WARN_ON(j != config_rom_length);
 }
 
 static void update_config_roms(void)
 {
        struct fw_card *card;
-       size_t length;
 
        list_for_each_entry (card, &card_list, link) {
-               length = generate_config_rom(card, tmp_config_rom);
-               card->driver->set_config_rom(card, tmp_config_rom, length);
+               generate_config_rom(card, tmp_config_rom);
+               card->driver->set_config_rom(card, tmp_config_rom,
+                                            config_rom_length);
        }
 }
 
+static size_t required_space(struct fw_descriptor *desc)
+{
+       /* descriptor + entry into root dir + optional immediate entry */
+       return desc->length + 1 + (desc->immediate > 0 ? 1 : 0);
+}
+
 int fw_core_add_descriptor(struct fw_descriptor *desc)
 {
        size_t i;
+       int ret;
 
        /*
         * Check descriptor is valid; the length of all blocks in the
@@ -175,15 +171,21 @@ int fw_core_add_descriptor(struct fw_descriptor *desc)
 
        mutex_lock(&card_mutex);
 
-       list_add_tail(&desc->link, &descriptor_list);
-       descriptor_count++;
-       if (desc->immediate > 0)
+       if (config_rom_length + required_space(desc) > 256) {
+               ret = -EBUSY;
+       } else {
+               list_add_tail(&desc->link, &descriptor_list);
+               config_rom_length += required_space(desc);
                descriptor_count++;
-       update_config_roms();
+               if (desc->immediate > 0)
+                       descriptor_count++;
+               update_config_roms();
+               ret = 0;
+       }
 
        mutex_unlock(&card_mutex);
 
-       return 0;
+       return ret;
 }
 EXPORT_SYMBOL(fw_core_add_descriptor);
 
@@ -192,6 +194,7 @@ void fw_core_remove_descriptor(struct fw_descriptor *desc)
        mutex_lock(&card_mutex);
 
        list_del(&desc->link);
+       config_rom_length -= required_space(desc);
        descriptor_count--;
        if (desc->immediate > 0)
                descriptor_count--;
@@ -441,7 +444,6 @@ EXPORT_SYMBOL(fw_card_initialize);
 int fw_card_add(struct fw_card *card,
                u32 max_receive, u32 link_speed, u64 guid)
 {
-       size_t length;
        int ret;
 
        card->max_receive = max_receive;
@@ -450,8 +452,8 @@ int fw_card_add(struct fw_card *card,
 
        mutex_lock(&card_mutex);
 
-       length = generate_config_rom(card, tmp_config_rom);
-       ret = card->driver->enable(card, tmp_config_rom, length);
+       generate_config_rom(card, tmp_config_rom);
+       ret = card->driver->enable(card, tmp_config_rom, config_rom_length);
        if (ret == 0)
                list_add_tail(&card->link, &card_list);