patch usb-eagle-and-adi-930-usb-adsl-modem-driver-fix.patch added to gregkh-2.6 tree

[gregkh at suse.de]

This is a note to let you know that I've just added the patch titled

     Subject: USB: Eagle and ADI 930 usb adsl modem driver fix

to my gregkh-2.6 tree.  Its filename is

     usb-eagle-and-adi-930-usb-adsl-modem-driver-fix.patch

This tree can be found at 
    http://www.kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/patches/

Patches currently in gregkh-2.6 which might be from castet.matthieu at free.fr are

usb/usb-eagle-and-adi-930-usb-adsl-modem-driver-fix.patch
usb/usb-eagle-and-adi-930-usb-adsl-modem-driver.patch


>From castet.matthieu at free.fr Mon Nov  7 15:03:36 2005
Message-ID: <436FDD06.607 at free.fr>
Date: Tue, 08 Nov 2005 00:02:30 +0100
From: matthieu castet <castet.matthieu at free.fr>
To: Greg KH <greg at kroah.com>
CC: Andrew Morton <akpm at osdl.org>,  <usbatm at lists.infradead.org>
Subject: USB: Eagle and ADI 930 usb adsl modem driver fix

More care on loading firmware, take into account fw->size can't be zero.

Signed-off-by: Matthieu CASTET <castet.matthieu at free.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

---
 drivers/usb/atm/ueagle-atm.c |   28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

--- gregkh-2.6.orig/drivers/usb/atm/ueagle-atm.c
+++ gregkh-2.6/drivers/usb/atm/ueagle-atm.c
@@ -426,14 +426,14 @@ static void uea_upload_pre_firmware(cons
 
 	pfw = fw_entry->data;
 	size = fw_entry->size;
+	if (size < 4)
+		goto err_fw_corrupted;
 
 	crc = FW_GET_LONG(pfw);
 	pfw += 4;
 	size -= 4;
-	if (crc32_be(0, pfw, size) != crc) {
-		uea_err(usb, "firmware is corrupted\n");
-		goto err;
-	}
+	if (crc32_be(0, pfw, size) != crc)
+		goto err_fw_corrupted;
 
 	/*
 	 * Start to upload formware : send reset
@@ -446,9 +446,14 @@ static void uea_upload_pre_firmware(cons
 		goto err;
 	}
 
-	while (size > 0) {
+	while (size > 3) {
 		u8 len = FW_GET_BYTE(pfw);
 		u16 add = FW_GET_WORD(pfw + 1);
+
+		size -= len + 3;
+		if (size < 0)
+			goto err_fw_corrupted;
+
 		ret = uea_send_modem_cmd(usb, add, len, pfw + 3);
 		if (ret < 0) {
 			uea_err(usb, "uploading firmware data failed "
@@ -456,9 +461,11 @@ static void uea_upload_pre_firmware(cons
 			goto err;
 		}
 		pfw += len + 3;
-		size -= len + 3;
 	}
 
+	if (size != 0)
+		goto err_fw_corrupted;
+
 	/*
 	 * Tell the modem we finish : de-assert reset
 	 */
@@ -469,6 +476,11 @@ static void uea_upload_pre_firmware(cons
 	else
 		uea_info(usb, "firmware uploaded\n");
 
+	uea_leaves(usb);
+	return;
+
+err_fw_corrupted:
+	uea_err(usb, "firmware is corrupted\n");
 err:
 	uea_leaves(usb);
 }
@@ -522,10 +534,6 @@ static int check_dsp(u8 *dsp, unsigned i
 	u32 pageoffset;
 	unsigned int i, j, p, pp;
 
-	/* enough space for pagecount? */
-	if (len < 1)
-		return 1;
-
 	pagecount = FW_GET_BYTE(dsp);
 	p = 1;