[PATCH] fix cdrom length check

There's a bad length check in cdrom_get_random_writable(), it's off-by-4
since fh->data_len is the length of data _after_ that field (which is
offset 4 bytes in the header).  Check is pretty bogus anyways, so just kill
it.

Signed-Off-By: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 01867107d947349dc63b50ad599915baf5b852bb..c1afb811270bf8dbb4367bb8a96dd1c6c4b11a7c 100644 (file)
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -651,7 +651,6 @@ int cdrom_get_random_writable(struct cdrom_device_info *cdi,
 {
        struct packet_command cgc;
        char buffer[24];
-       struct feature_header *fh;
        int ret;
 
        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
@@ -664,14 +663,7 @@ int cdrom_get_random_writable(struct cdrom_device_info *cdi,
        if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
                return ret;
 
-       fh = (struct feature_header *)&buffer[0];
-       if (be32_to_cpu(fh->data_len) >= (sizeof(struct feature_header)+
-                                         sizeof(struct rwrt_feature_desc)))
-               memcpy(rfd, &buffer[sizeof(struct feature_header)],
-                      sizeof (*rfd));
-       else
-               memset(rfd, 0, sizeof(*rfd));
-
+       memcpy(rfd, &buffer[sizeof(struct feature_header)], sizeof (*rfd));
        return 0;
 }