---

yaml
---
r: 135990
b: refs/heads/master
c: 1f3125a
h: refs/heads/master
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bf8e3355ec8f4e472f9841e94203cd759b45226e
+refs/heads/master: 1f3125af8ed7410cc0ebcc0acd59bbfc1ae0057a

trunk/drivers/firewire/fw-cdev.c

@@ -398,6 +398,7 @@ static int ioctl_send_request(struct client *client, void *buffer)
 	struct fw_device *device = client->device;
 	struct fw_cdev_send_request *request = buffer;
 	struct response *response;
+	int ret;
 
 	/* What is the biggest size we'll accept, really? */
 	if (request->length > 4096)
@@ -414,8 +415,26 @@ static int ioctl_send_request(struct client *client, void *buffer)
 	if (request->data &&
 	    copy_from_user(response->response.data,
 			   u64_to_uptr(request->data), request->length)) {
-		kfree(response);
-		return -EFAULT;
+		ret = -EFAULT;
+		goto err;
+	}
+
+	switch (request->tcode) {
+	case TCODE_WRITE_QUADLET_REQUEST:
+	case TCODE_WRITE_BLOCK_REQUEST:
+	case TCODE_READ_QUADLET_REQUEST:
+	case TCODE_READ_BLOCK_REQUEST:
+	case TCODE_LOCK_MASK_SWAP:
+	case TCODE_LOCK_COMPARE_SWAP:
+	case TCODE_LOCK_FETCH_ADD:
+	case TCODE_LOCK_LITTLE_ADD:
+	case TCODE_LOCK_BOUNDED_ADD:
+	case TCODE_LOCK_WRAP_ADD:
+	case TCODE_LOCK_VENDOR_DEPENDENT:
+		break;
+	default:
+		ret = -EINVAL;
+		goto err;
 	}
 
 	response->resource.release = release_transaction;
@@ -434,6 +453,10 @@ static int ioctl_send_request(struct client *client, void *buffer)
 		return sizeof(request) + request->length;
 	else
 		return sizeof(request);
+ err:
+	kfree(response);
+
+	return ret;
 }
 
 struct address_handler {