3 files changed, 37 insertions, 23 deletions

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 702dcc98c074..14a34d99eea2 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -960,6 +960,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
                 u.packet.header_length = GET_HEADER_LENGTH(control);
 
                 if (ctx->type == FW_ISO_CONTEXT_TRANSMIT) {
+                        if (u.packet.header_length % 4 != 0)
+                                return -EINVAL;
                         header_length = u.packet.header_length;
                 } else {
                         /*
@@ -969,7 +971,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
                         if (ctx->header_size == 0) {
                                 if (u.packet.header_length > 0)
                                         return -EINVAL;
-                        } else if (u.packet.header_length % ctx->header_size != 0) {
+                        } else if (u.packet.header_length == 0 ||
+                                   u.packet.header_length % ctx->header_size != 0) {
                                 return -EINVAL;
                         }
                         header_length = 0;
@@ -1354,24 +1357,24 @@ static int dispatch_ioctl(struct client *client,
                 return -ENODEV;
 
         if (_IOC_TYPE(cmd) != '#' ||
-            _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers))
+            _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
+            _IOC_SIZE(cmd) > sizeof(buffer))
                 return -EINVAL;
 
-        if (_IOC_DIR(cmd) & _IOC_WRITE) {
-                if (_IOC_SIZE(cmd) > sizeof(buffer) ||
-                    copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
+        if (_IOC_DIR(cmd) == _IOC_READ)
+                memset(&buffer, 0, _IOC_SIZE(cmd));
+
+        if (_IOC_DIR(cmd) & _IOC_WRITE)
+                if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
                         return -EFAULT;
-        }
 
         ret = ioctl_handlers[_IOC_NR(cmd)](client, &buffer);
         if (ret < 0)
                 return ret;
 
-        if (_IOC_DIR(cmd) & _IOC_READ) {
-                if (_IOC_SIZE(cmd) > sizeof(buffer) ||
-                    copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
+        if (_IOC_DIR(cmd) & _IOC_READ)
+                if (copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
                         return -EFAULT;
-        }
 
         return ret;
 }
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 3784a47865b7..8f5aebfb29df 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -190,7 +190,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
         for (try = 0; try < 5; try++) {
                 new = allocate ? old - bandwidth : old + bandwidth;
                 if (new < 0 || new > BANDWIDTH_AVAILABLE_INITIAL)
-                        break;
+                        return -EBUSY;
 
                 data[0] = cpu_to_be32(old);
                 data[1] = cpu_to_be32(new);
@@ -218,7 +218,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                 u32 channels_mask, u64 offset, bool allocate, __be32 data[2])
 {
         __be32 c, all, old;
-        int i, retry = 5;
+        int i, ret = -EIO, retry = 5;
 
         old = all = allocate ? cpu_to_be32(~0) : 0;
 
@@ -226,6 +226,8 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                 if (!(channels_mask & 1 << i))
                         continue;
 
+                ret = -EBUSY;
+
                 c = cpu_to_be32(1 << (31 - i));
                 if ((old & c) != (all & c))
                         continue;
@@ -251,12 +253,16 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
 
                         /* 1394-1995 IRM, fall through to retry. */
                 default:
-                        if (retry--)
+                        if (retry) {
+                                retry--;
                                 i--;
+                        } else {
+                                ret = -EIO;
+                        }
                 }
         }
 
-        return -EIO;
+        return ret;
 }
 
 static void deallocate_channel(struct fw_card *card, int irm_id,
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 0cf4d7f562c5..94b16e0340ae 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -1158,7 +1158,7 @@ static void handle_local_lock(struct fw_ohci *ohci,
                               struct fw_packet *packet, u32 csr)
 {
         struct fw_packet response;
-        int tcode, length, ext_tcode, sel;
+        int tcode, length, ext_tcode, sel, try;
         __be32 *payload, lock_old;
         u32 lock_arg, lock_data;
 
@@ -1185,21 +1185,26 @@ static void handle_local_lock(struct fw_ohci *ohci,
         reg_write(ohci, OHCI1394_CSRCompareData, lock_arg);
         reg_write(ohci, OHCI1394_CSRControl, sel);
 
-        if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000)
-                lock_old = cpu_to_be32(reg_read(ohci, OHCI1394_CSRData));
-        else
-                fw_notify("swap not done yet\n");
+        for (try = 0; try < 20; try++)
+                if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000) {
+                        lock_old = cpu_to_be32(reg_read(ohci,
+                                                        OHCI1394_CSRData));
+                        fw_fill_response(&response, packet->header,
+                                         RCODE_COMPLETE,
+                                         &lock_old, sizeof(lock_old));
+                        goto out;
+                }
+
+        fw_error("swap not done (CSR lock timeout)\n");
+        fw_fill_response(&response, packet->header, RCODE_BUSY, NULL, 0);
 
-        fw_fill_response(&response, packet->header,
-                         RCODE_COMPLETE, &lock_old, sizeof(lock_old));
  out:
         fw_core_handle_response(&ohci->card, &response);
 }
 
 static void handle_local_request(struct context *ctx, struct fw_packet *packet)
 {
-        u64 offset;
-        u32 csr;
+        u64 offset, csr;
 
         if (ctx == &ctx->ohci->at_request_ctx) {
                 packet->ack = ACK_PENDING;