1 files changed, 13 insertions, 1 deletions

diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index fce364c6c71a..f876eed7d4aa 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -87,6 +87,8 @@ static inline void iriap_start_watchdog_timer(struct iriap_cb *self,
                          iriap_watchdog_timer_expired);
 }
 
+static struct lock_class_key irias_objects_key;
+
 /*
  * Function iriap_init (void)
  *
@@ -114,6 +116,9 @@ int __init iriap_init(void)
                 return -ENOMEM;
         }
 
+        lockdep_set_class_and_name(&irias_objects->hb_spinlock, &irias_objects_key,
+                                   "irias_objects");
+
         /*
          *  Register some default services for IrLMP
          */
@@ -502,7 +507,8 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
                 IRDA_DEBUG(4, "%s(), strlen=%d\n", __func__, value_len);
 
                 /* Make sure the string is null-terminated */
-                fp[n+value_len] = 0x00;
+                if (n + value_len < skb->len)
+                        fp[n + value_len] = 0x00;
                 IRDA_DEBUG(4, "Got string %s\n", fp+n);
 
                 /* Will truncate to IAS_MAX_STRING bytes */
@@ -655,10 +661,16 @@ static void iriap_getvaluebyclass_indication(struct iriap_cb *self,
         n = 1;
 
         name_len = fp[n++];
+
+        IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);
+
         memcpy(name, fp+n, name_len); n+=name_len;
         name[name_len] = '\0';
 
         attr_len = fp[n++];
+
+        IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);
+
         memcpy(attr, fp+n, attr_len); n+=attr_len;
         attr[attr_len] = '\0';