diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-10-02 11:32:34 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-10-19 15:53:04 -0400 |
| commit | 264e989a0b347c61bd3258063eac8b86f55ff037 (patch) | |
| tree | e874e2c843d2ef13f26c67448c62181620557f2f | |
| parent | 2b4766c3008aa99a60415a6f321ac0dad94852f1 (diff) | |
| download | linux-264e989a0b347c61bd3258063eac8b86f55ff037.tar.bz2 | |
orinoco_usb: clean up some signedness issues
In ezusb_read_ltv() we had a comparison "(bufsize < 0)" which was never
true because bufsize was unsigned. I looked at the implications of
that. If we passed a negative number to ezusb_access_ltv() then it
would be used as the size parameter of the memcpy() because that
function uses min_t(int, exp_len, ans_size).
But fortunately when I looked at the callers, bufsize is not controlled
by the user and it's never negative. So these signedness mistakes have
no impact.
I removed the always false check from ezusb_read_ltv() and I changed the
types in ezusb_access_ltv() and made the variables unsigned.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/orinoco/orinoco_usb.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c index 7f53cea2f205..01624dcaf73e 100644 --- a/drivers/net/wireless/orinoco/orinoco_usb.c +++ b/drivers/net/wireless/orinoco/orinoco_usb.c @@ -865,7 +865,7 @@ static int ezusb_firmware_download(struct ezusb_priv *upriv, static int ezusb_access_ltv(struct ezusb_priv *upriv, struct request_context *ctx, u16 length, const void *data, u16 frame_type, - void *ans_buff, int ans_size, u16 *ans_length) + void *ans_buff, unsigned ans_size, u16 *ans_length) { int req_size; int retval = 0; @@ -933,7 +933,7 @@ static int ezusb_access_ltv(struct ezusb_priv *upriv, } if (ctx->in_rid) { struct ezusb_packet *ans = ctx->buf; - int exp_len; + unsigned exp_len; if (ans->hermes_len != 0) exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12; @@ -949,8 +949,7 @@ static int ezusb_access_ltv(struct ezusb_priv *upriv, } if (ans_buff) - memcpy(ans_buff, ans->data, - min_t(int, exp_len, ans_size)); + memcpy(ans_buff, ans->data, min(exp_len, ans_size)); if (ans_length) *ans_length = le16_to_cpu(ans->hermes_len); } @@ -995,7 +994,7 @@ static int ezusb_read_ltv(struct hermes *hw, int bap, u16 rid, struct ezusb_priv *upriv = hw->priv; struct request_context *ctx; - if ((bufsize < 0) || (bufsize % 2)) + if (bufsize % 2) return -EINVAL; ctx = ezusb_alloc_ctx(upriv, rid, rid); |