#include <linux/poll.h>
#include <linux/module.h>
#include <linux/init.h>
-#include <linux/smp_lock.h>
#include <linux/interrupt.h>
#include <linux/vmalloc.h>
#include <linux/cdev.h>
int header_length = req->req.misc & 0xffff;
int expect_response = req->req.misc >> 16;
- if ((header_length > req->req.length) || (header_length < 12)) {
+ if (header_length > req->req.length || header_length < 12 ||
+ header_length > FIELD_SIZEOF(struct hpsb_packet, header)) {
req->req.error = RAW1394_ERROR_INVALID_ARG;
req->req.length = 0;
queue_complete_req(req);