From patchwork Tue Oct 2 08:32:34 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 1536361 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 2A85DDF238 for ; Tue, 2 Oct 2012 08:33:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754653Ab2JBIdI (ORCPT ); Tue, 2 Oct 2012 04:33:08 -0400 Received: from acsinet15.oracle.com ([141.146.126.227]:32540 "EHLO acsinet15.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754225Ab2JBIdE (ORCPT ); Tue, 2 Oct 2012 04:33:04 -0400 Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by acsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q928WhSQ014365 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 2 Oct 2012 08:32:45 GMT Received: from acsmt356.oracle.com (acsmt356.oracle.com [141.146.40.156]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q928Wgfv002199 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 2 Oct 2012 08:32:42 GMT Received: from abhmt105.oracle.com (abhmt105.oracle.com [141.146.116.57]) by acsmt356.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id q928WgsU008050; Tue, 2 Oct 2012 03:32:42 -0500 Received: from elgon.mountain (/41.212.103.53) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 02 Oct 2012 01:32:41 -0700 Date: Tue, 2 Oct 2012 11:32:34 +0300 From: Dan Carpenter To: "John W. Linville" Cc: Sarah Sharp , Greg Kroah-Hartman , linux-wireless@vger.kernel.org, linux-usb@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] orinoco_usb: clean up some signedness issues Message-ID: <20121002083234.GL12398@elgon.mountain> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org In ezusb_read_ltv() we had a comparison "(bufsize < 0)" which was never true because bufsize was unsigned. I looked at the implications of that. If we passed a negative number to ezusb_access_ltv() then it would be used as the size parameter of the memcpy() because that function uses min_t(int, exp_len, ans_size). But fortunately when I looked at the callers, bufsize is not controlled by the user and it's never negative. So these signedness mistakes have no impact. I removed the always false check from ezusb_read_ltv() and I changed the types in ezusb_access_ltv() and made the variables unsigned. Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c index 7f53cea2..01624dc 100644 --- a/drivers/net/wireless/orinoco/orinoco_usb.c +++ b/drivers/net/wireless/orinoco/orinoco_usb.c @@ -865,7 +865,7 @@ static int ezusb_firmware_download(struct ezusb_priv *upriv, static int ezusb_access_ltv(struct ezusb_priv *upriv, struct request_context *ctx, u16 length, const void *data, u16 frame_type, - void *ans_buff, int ans_size, u16 *ans_length) + void *ans_buff, unsigned ans_size, u16 *ans_length) { int req_size; int retval = 0; @@ -933,7 +933,7 @@ static int ezusb_access_ltv(struct ezusb_priv *upriv, } if (ctx->in_rid) { struct ezusb_packet *ans = ctx->buf; - int exp_len; + unsigned exp_len; if (ans->hermes_len != 0) exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12; @@ -949,8 +949,7 @@ static int ezusb_access_ltv(struct ezusb_priv *upriv, } if (ans_buff) - memcpy(ans_buff, ans->data, - min_t(int, exp_len, ans_size)); + memcpy(ans_buff, ans->data, min(exp_len, ans_size)); if (ans_length) *ans_length = le16_to_cpu(ans->hermes_len); } @@ -995,7 +994,7 @@ static int ezusb_read_ltv(struct hermes *hw, int bap, u16 rid, struct ezusb_priv *upriv = hw->priv; struct request_context *ctx; - if ((bufsize < 0) || (bufsize % 2)) + if (bufsize % 2) return -EINVAL; ctx = ezusb_alloc_ctx(upriv, rid, rid);