From 2cc68edf8207aaca17eb992d507c72e853cb7df7 Mon Sep 17 00:00:00 2001 From: Stefan Richter Date: Sun, 1 Jul 2007 13:56:03 +0200 Subject: [PATCH] --- yaml --- r: 58456 b: refs/heads/master c: 332ef3310bc37ff29fd4382d6dfb38a787078091 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/firewire/fw-sbp2.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index 6f4b2b5908ad..ce690939780d 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 9fb2dd12c019965ffd15e5a0727af14488b3a772 +refs/heads/master: 332ef3310bc37ff29fd4382d6dfb38a787078091 diff --git a/trunk/drivers/firewire/fw-sbp2.c b/trunk/drivers/firewire/fw-sbp2.c index 212674d723e3..c7518ea4c8ee 100644 --- a/trunk/drivers/firewire/fw-sbp2.c +++ b/trunk/drivers/firewire/fw-sbp2.c @@ -937,6 +937,11 @@ static int sbp2_command_orb_map_scatterlist(struct sbp2_command_orb *orb) sg_len = sg_dma_len(sg + i); sg_addr = sg_dma_address(sg + i); while (sg_len) { + /* FIXME: This won't get us out of the pinch. */ + if (unlikely(j >= ARRAY_SIZE(orb->page_table))) { + fw_error("page table overflow\n"); + goto fail_page_table; + } l = min(sg_len, SBP2_MAX_SG_ELEMENT_LENGTH); orb->page_table[j].low = sg_addr; orb->page_table[j].high = (l << 16);