aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPhillip Susi <psusi@cfl.rr.com>2006-02-04 23:27:44 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2006-02-05 11:06:52 -0800
commita460ad62260def15c42130de253d6cfc32528a2f (patch)
tree6fd5b90db456ae6a333a224b8c1c975474bb3c27
parentbd576c9523fbf23e94fb7dbe05d2ae1cf96864e4 (diff)
[PATCH] pktcdvd: Fix overflow for discs with large packets
The pktcdvd driver was using an 8 bit field to store the packet length obtained from the disc track info. This causes it to overflow packet length values of 128KB or more. I changed the field to 32 bits to fix this. The pktcdvd driver defaulted to its maximum allowed packet length when it detected a 0 in the track info field. I changed this to fail the operation and refuse to access the media. This seems more sane than attempting to access it with a value that almost certainly will not work. Signed-off-by: Peter Osterlund <petero2@telia.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--drivers/block/pktcdvd.c2
-rw-r--r--include/linux/pktcdvd.h2
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 93affeeef7b..d95e7e1ac35 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -1639,7 +1639,7 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
pd->settings.size = be32_to_cpu(ti.fixed_packet_size) << 2;
if (pd->settings.size == 0) {
printk("pktcdvd: detected zero packet size!\n");
- pd->settings.size = 128;
+ return -ENXIO;
}
if (pd->settings.size > PACKET_MAX_SECTORS) {
printk("pktcdvd: packet size is too big\n");
diff --git a/include/linux/pktcdvd.h b/include/linux/pktcdvd.h
index 2c177e4c8f2..d1c9c4a86e5 100644
--- a/include/linux/pktcdvd.h
+++ b/include/linux/pktcdvd.h
@@ -114,7 +114,7 @@ struct pkt_ctrl_command {
struct packet_settings
{
- __u8 size; /* packet size in (512 byte) sectors */
+ __u32 size; /* packet size in (512 byte) sectors */
__u8 fp; /* fixed packets */
__u8 link_loss; /* the rest is specified
* as per Mt Fuji */