s390/qeth: fix SETIP command handling

[pandora-kernel.git] / drivers / s390 / net / qeth_core_main.c

diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 8153443..3a0b5fc 100644 (file)
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -881,7 +881,6 @@ EXPORT_SYMBOL_GPL(qeth_do_run_thread);
 void qeth_schedule_recovery(struct qeth_card *card)
 {
        QETH_CARD_TEXT(card, 2, "startrec");
-       WARN_ON(1);
        if (qeth_set_thread_start_bit(card, QETH_RECOVER_THREAD) == 0)
                schedule_work(&card->kernel_thread_starter);
 }
@@ -1933,7 +1932,7 @@ int qeth_send_control_data(struct qeth_card *card, int len,
        unsigned long flags;
        struct qeth_reply *reply = NULL;
        unsigned long timeout, event_timeout;
-       struct qeth_ipa_cmd *cmd;
+       struct qeth_ipa_cmd *cmd = NULL;
 
        QETH_CARD_TEXT(card, 2, "sendctl");
 
@@ -1960,10 +1959,13 @@ int qeth_send_control_data(struct qeth_card *card, int len,
        while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ;
        qeth_prepare_control_data(card, len, iob);
 
-       if (IS_IPA(iob->data))
+       if (IS_IPA(iob->data)) {
+               cmd = __ipa_cmd(iob);
                event_timeout = QETH_IPA_TIMEOUT;
-       else
+       } else {
                event_timeout = QETH_TIMEOUT;
+       }
+
        timeout = jiffies + event_timeout;
 
        QETH_CARD_TEXT(card, 6, "noirqpnd");
@@ -1988,9 +1990,8 @@ int qeth_send_control_data(struct qeth_card *card, int len,
 
        /* we have only one long running ipassist, since we can ensure
           process context of this command we can sleep */
-       cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-       if ((cmd->hdr.command == IPA_CMD_SETIP) &&
-           (cmd->hdr.prot_version == QETH_PROT_IPV4)) {
+       if (cmd && cmd->hdr.command == IPA_CMD_SETIP &&
+           cmd->hdr.prot_version == QETH_PROT_IPV4) {
                if (!wait_event_timeout(reply->wait_q,
                    atomic_read(&reply->received), event_timeout))
                        goto time_err;
@@ -4323,7 +4324,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
        struct qeth_cmd_buffer *iob;
        struct qeth_ipa_cmd *cmd;
        struct qeth_snmp_ureq *ureq;
-       int req_len;
+       unsigned int req_len;
        struct qeth_arp_query_info qinfo = {0, };
        int rc = 0;
 
@@ -4339,6 +4340,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
        /* skip 4 bytes (data_len struct member) to get req_len */
        if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int)))
                return -EFAULT;
+       if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE -
+                      sizeof(struct qeth_ipacmd_hdr) -
+                      sizeof(struct qeth_ipacmd_setadpparms_hdr)))
+               return -EINVAL;
        ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr));
        if (IS_ERR(ureq)) {
                QETH_CARD_TEXT(card, 2, "snmpnome");