aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric Sesterhenn <snakebyte@gmx.de>2006-06-01 23:48:45 -0400
committerGreg Kroah-Hartman <gregkh@suse.de>2006-06-21 18:04:15 -0400
commitd5ce1379be9c79d4bcf201c20c5cc87bb2bc973c (patch)
tree35920fe3fd457b4a472dfa999b76393637d2d544
parentb10cee9d035db54d0bf5a9f9fa622dcfc3f740c6 (diff)
[PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c
From: Eric Sesterhenn <snakebyte@gmx.de> This fixes coverity Bug #390. With the following code ret = ep->branch = balance(isp116x, ep->period, ep->load); if (ret < 0) goto fail; the problem is that ret and balance are of the type int, and ep->branch is u16. so the int balance() returns gets reduced to u16 and then converted to an int again, which removes the sign. Maybe the following little c program can explain it better:
-rw-r--r--drivers/usb/host/isp116x-hcd.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index e99210b7909b..c5e224048efa 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
781 if (ep->branch < PERIODIC_SIZE) 781 if (ep->branch < PERIODIC_SIZE)
782 break; 782 break;
783 783
784 ret = ep->branch = balance(isp116x, ep->period, ep->load); 784 ep->branch = ret = balance(isp116x, ep->period, ep->load);
785 if (ret < 0) 785 if (ret < 0)
786 goto fail; 786 goto fail;
787 ret = 0; 787 ret = 0;