1 files changed, 22 insertions, 27 deletions

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 192af59afc13..868ff2ce1675 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -440,19 +440,18 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                 if (!kbuf)
                         return -ENOMEM;
                 while (count > 0) {
-                        int len = size_inside_page(p, count);
-
-                        len = vread(kbuf, (char *)p, len);
-                        if (!len)
+                        sz = size_inside_page(p, count);
+                        sz = vread(kbuf, (char *)p, sz);
+                        if (!sz)
                                 break;
-                        if (copy_to_user(buf, kbuf, len)) {
+                        if (copy_to_user(buf, kbuf, sz)) {
                                 free_page((unsigned long)kbuf);
                                 return -EFAULT;
                         }
-                        count -= len;
-                        buf += len;
-                        read += len;
-                        p += len;
+                        count -= sz;
+                        buf += sz;
+                        read += sz;
+                        p += sz;
                 }
                 free_page((unsigned long)kbuf);
         }
@@ -522,19 +521,14 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
         unsigned long p = *ppos;
         ssize_t wrote = 0;
         ssize_t virtr = 0;
-        ssize_t written;
         char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
 
         if (p < (unsigned long) high_memory) {
-
-                wrote = count;
-                if (count > (unsigned long) high_memory - p)
-                        wrote = (unsigned long) high_memory - p;
-
-                written = do_write_kmem((void*)p, p, buf, wrote, ppos);
-                if (written != wrote)
-                        return written;
-                wrote = written;
+                unsigned long to_write = min_t(unsigned long, count,
+                                               (unsigned long)high_memory - p);
+                wrote = do_write_kmem((void *)p, p, buf, to_write, ppos);
+                if (wrote != to_write)
+                        return wrote;
                 p += wrote;
                 buf += wrote;
                 count -= wrote;
@@ -545,20 +539,21 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                 if (!kbuf)
                         return wrote ? wrote : -ENOMEM;
                 while (count > 0) {
-                        int len = size_inside_page(p, count);
+                        unsigned long sz = size_inside_page(p, count);
+                        unsigned long n;
 
-                        written = copy_from_user(kbuf, buf, len);
-                        if (written) {
+                        n = copy_from_user(kbuf, buf, sz);
+                        if (n) {
                                 if (wrote + virtr)
                                         break;
                                 free_page((unsigned long)kbuf);
                                 return -EFAULT;
                         }
-                        len = vwrite(kbuf, (char *)p, len);
-                        count -= len;
-                        buf += len;
-                        virtr += len;
-                        p += len;
+                        sz = vwrite(kbuf, (char *)p, sz);
+                        count -= sz;
+                        buf += sz;
+                        virtr += sz;
+                        p += sz;
                 }
                 free_page((unsigned long)kbuf);
         }