aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTilman Schmidt <tilman@imap.cc>2008-07-24 00:28:27 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-24 13:47:22 -0400
commit5f09c4c797d00bef5700e1ca085b4efcedaf34b8 (patch)
tree126772d4fb24001bf57590f7532be7557086cc4c
parent5002779d37b261271da9883e06c14b097d4781c4 (diff)
gigaset: gigaset_isowbuf_getbytes() may return signed unnoticed
ifd->offset is unsigned. gigaset_isowbuf_getbytes() may return signed unnoticed. Revised version of patch originally submitted by Roel Kluin <12o3l@tiscali.nl>. Signed-off-by: Tilman Schmidt <tilman@imap.cc> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/isdn/gigaset/bas-gigaset.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 5255b5e20e13..3f11910c7ccd 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -1050,10 +1050,9 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
1050 } 1050 }
1051 1051
1052 /* retrieve block of data to send */ 1052 /* retrieve block of data to send */
1053 ifd->offset = gigaset_isowbuf_getbytes(ubc->isooutbuf, 1053 rc = gigaset_isowbuf_getbytes(ubc->isooutbuf, ifd->length);
1054 ifd->length); 1054 if (rc < 0) {
1055 if (ifd->offset < 0) { 1055 if (rc == -EBUSY) {
1056 if (ifd->offset == -EBUSY) {
1057 gig_dbg(DEBUG_ISO, 1056 gig_dbg(DEBUG_ISO,
1058 "%s: buffer busy at frame %d", 1057 "%s: buffer busy at frame %d",
1059 __func__, nframe); 1058 __func__, nframe);
@@ -1062,11 +1061,12 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
1062 } else { 1061 } else {
1063 dev_err(ucx->bcs->cs->dev, 1062 dev_err(ucx->bcs->cs->dev,
1064 "%s: buffer error %d at frame %d\n", 1063 "%s: buffer error %d at frame %d\n",
1065 __func__, ifd->offset, nframe); 1064 __func__, rc, nframe);
1066 return ifd->offset; 1065 return rc;
1067 } 1066 }
1068 break; 1067 break;
1069 } 1068 }
1069 ifd->offset = rc;
1070 ucx->limit = ubc->isooutbuf->nextread; 1070 ucx->limit = ubc->isooutbuf->nextread;
1071 ifd->status = 0; 1071 ifd->status = 0;
1072 ifd->actual_length = 0; 1072 ifd->actual_length = 0;