1 files changed, 16 insertions, 10 deletions

diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index 070c6219e2d6..ac0e3e4b3c54 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -267,16 +267,13 @@ int mpc83xx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
         cs->hw_mode |= SPMODE_LEN(bits_per_word);
 
         if ((mpc83xx_spi->spibrg / hz) > 64) {
+                cs->hw_mode |= SPMODE_DIV16;
                 pm = mpc83xx_spi->spibrg / (hz * 64);
                 if (pm > 16) {
-                        cs->hw_mode |= SPMODE_DIV16;
-                        pm /= 16;
-                        if (pm > 16) {
-                                dev_err(&spi->dev, "Requested speed is too "
-                                        "low: %d Hz. Will use %d Hz instead.\n",
-                                        hz, mpc83xx_spi->spibrg / 1024);
-                                pm = 16;
-                        }
+                        dev_err(&spi->dev, "Requested speed is too "
+                                "low: %d Hz. Will use %d Hz instead.\n",
+                                hz, mpc83xx_spi->spibrg / 1024);
+                        pm = 16;
                 }
         } else
                 pm = mpc83xx_spi->spibrg / (hz * 4);
@@ -315,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
         if (t->bits_per_word)
                 bits_per_word = t->bits_per_word;
         len = t->len;
-        if (bits_per_word > 8)
+        if (bits_per_word > 8) {
+                /* invalid length? */
+                if (len & 1)
+                        return -EINVAL;
                 len /= 2;
-        if (bits_per_word > 16)
+        }
+        if (bits_per_word > 16) {
+                /* invalid length? */
+                if (len & 1)
+                        return -EINVAL;
                 len /= 2;
+        }
         mpc83xx_spi->count = len;
+
         INIT_COMPLETION(mpc83xx_spi->done);
 
         /* enable rx ints */