diff options
| author | David S. Miller <davem@davemloft.net> | 2009-02-24 12:50:29 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-02-24 12:50:29 +0100 |
| commit | e70049b9e74267dd47e1ffa62302073487afcb48 (patch) | |
| tree | 2cd000c0751ef31c9044b020d63f278cdf4f332d /drivers/s390 | |
| parent | Doc: Refer to ip-sysctl.txt for strict vs. loose rp_filter mode (diff) | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 (diff) | |
| download | linux-e70049b9e74267dd47e1ffa62302073487afcb48.tar.xz linux-e70049b9e74267dd47e1ffa62302073487afcb48.zip | |
Merge branch 'master' of /home/davem/src/GIT/linux-2.6/
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/char/sclp.c | 5 | ||||
| -rw-r--r-- | drivers/s390/char/sclp_cmd.c | 5 |
2 files changed, 9 insertions, 1 deletions
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c index 1fd8f2193ed8..4377e93a43d7 100644 --- a/drivers/s390/char/sclp.c +++ b/drivers/s390/char/sclp.c @@ -280,8 +280,11 @@ sclp_dispatch_evbufs(struct sccb_header *sccb) rc = 0; for (offset = sizeof(struct sccb_header); offset < sccb->length; offset += evbuf->length) { - /* Search for event handler */ evbuf = (struct evbuf_header *) ((addr_t) sccb + offset); + /* Check for malformed hardware response */ + if (evbuf->length == 0) + break; + /* Search for event handler */ reg = NULL; list_for_each(l, &sclp_reg_list) { reg = list_entry(l, struct sclp_register, list); diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c index 506390496416..77ab6e34a100 100644 --- a/drivers/s390/char/sclp_cmd.c +++ b/drivers/s390/char/sclp_cmd.c @@ -19,6 +19,7 @@ #include <linux/memory.h> #include <asm/chpid.h> #include <asm/sclp.h> +#include <asm/setup.h> #include "sclp.h" @@ -474,6 +475,10 @@ static void __init add_memory_merged(u16 rn) goto skip_add; if (start + size > VMEM_MAX_PHYS) size = VMEM_MAX_PHYS - start; + if (memory_end_set && (start >= memory_end)) + goto skip_add; + if (memory_end_set && (start + size > memory_end)) + size = memory_end - start; add_memory(0, start, size); skip_add: first_rn = rn; |