From 9dfc02a38c1aad345d0027f637188b99523db207 Mon Sep 17 00:00:00 2001 From: Oron Peled Date: Mon, 16 Nov 2015 15:42:21 -0500 Subject: [PATCH] xpp: Check command type by length Prepare for different types of commands: Don't assume a constant size. Signed-off-by: Tzafrir Cohen --- drivers/dahdi/xpp/card_fxs.c | 16 +++++++++------- drivers/dahdi/xpp/card_global.c | 7 ++++++- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/dahdi/xpp/card_fxs.c b/drivers/dahdi/xpp/card_fxs.c index 9fd7ef6..b1a66f1 100644 --- a/drivers/dahdi/xpp/card_fxs.c +++ b/drivers/dahdi/xpp/card_fxs.c @@ -1579,17 +1579,19 @@ static int FXS_card_register_reply(xbus_t *xbus, xpd_t *xpd, reg_cmd_t *info) { unsigned long flags; struct FXS_priv_data *priv; - __u8 regnum; - bool indirect; + __u8 regnum = 0; + bool indirect = 0; spin_lock_irqsave(&xpd->lock, flags); priv = xpd->priv; BUG_ON(!priv); - indirect = (REG_FIELD(info, regnum) == 0x1E); - regnum = (indirect) ? REG_FIELD(info, subreg) : REG_FIELD(info, regnum); - XPD_DBG(REGS, xpd, "%s reg_num=0x%X, dataL=0x%X dataH=0x%X\n", - (indirect) ? "I" : "D", regnum, REG_FIELD(info, data_low), - REG_FIELD(info, data_high)); + if (info->h.bytes == REG_CMD_SIZE(REG)) { + indirect = (REG_FIELD(info, regnum) == 0x1E); + regnum = (indirect) ? REG_FIELD(info, subreg) : REG_FIELD(info, regnum); + XPD_DBG(REGS, xpd, "%s reg_num=0x%X, dataL=0x%X dataH=0x%X\n", + (indirect) ? "I" : "D", regnum, REG_FIELD(info, data_low), + REG_FIELD(info, data_high)); + } if (!indirect && regnum == REG_DTMF_DECODE) { __u8 val = REG_FIELD(info, data_low); diff --git a/drivers/dahdi/xpp/card_global.c b/drivers/dahdi/xpp/card_global.c index ac7167e..7e34231 100644 --- a/drivers/dahdi/xpp/card_global.c +++ b/drivers/dahdi/xpp/card_global.c @@ -600,7 +600,12 @@ HANDLER_DEF(GLOBAL, REGISTER_REPLY) "REGISTER_REPLY: missing card_register_reply()\n"); return -EINVAL; } - return CALL_XMETHOD(card_register_reply, xpd, reg); + switch (reg->h.bytes) { + case REG_CMD_SIZE(REG): + return CALL_XMETHOD(card_register_reply, xpd, reg); + } + XPD_ERR(xpd, "REGISTER_REPLY: bad packet_len=%d\n", pack->head.packet_len); + return -EINVAL; } HANDLER_DEF(GLOBAL, SYNC_REPLY)