aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/firewire/core-device.c18
1 files changed, 11 insertions, 7 deletions
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index e02bf2dff845..01cb6a327e29 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -588,15 +588,19 @@ static int read_bus_info_block(struct fw_device *device, int generation)
588 if (read_rom(device, generation, i, &rom[i]) != RCODE_COMPLETE) 588 if (read_rom(device, generation, i, &rom[i]) != RCODE_COMPLETE)
589 goto out; 589 goto out;
590 end = i + (rom[i] >> 16) + 1; 590 end = i + (rom[i] >> 16) + 1;
591 i++; 591 if (end > READ_BIB_ROM_SIZE) {
592 if (end > READ_BIB_ROM_SIZE)
593 /* 592 /*
594 * This block extends outside standard config 593 * This block extends outside the config ROM which is
595 * area (and the array we're reading it 594 * a firmware bug. Ignore this whole block, i.e.
596 * into). That's broken, so ignore this 595 * simply set a fake block length of 0.
597 * device.
598 */ 596 */
599 goto out; 597 fw_error("skipped invalid ROM block %x at %llx\n",
598 rom[i],
599 i * 4 | CSR_REGISTER_BASE | CSR_CONFIG_ROM);
600 rom[i] = 0;
601 end = i;
602 }
603 i++;
600 604
601 /* 605 /*
602 * Now read in the block. If this is a directory 606 * Now read in the block. If this is a directory