All of lore.kernel.org
 help / color / mirror / Atom feed
* [U-Boot] [PATCH] usb: storage: Fix overwritten in usb_stor_set_max_xfer_blk()
@ 2017-09-28  4:50 Bin Meng
  2017-09-28 15:24 ` Marek Vasut
  0 siblings, 1 reply; 8+ messages in thread
From: Bin Meng @ 2017-09-28  4:50 UTC (permalink / raw)
  To: u-boot

The stored 'blk' value is overwritten to 'size / 512' before it can
be used in usb_stor_set_max_xfer_blk(). This is not what we want.
In fact, when 'size' exceeds the upper limit (USHRT_MAX * 512), we
should simply assign 'size' to the upper limit.

Reported-by: Coverity (CID: 167250)
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
---

 common/usb_storage.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/usb_storage.c b/common/usb_storage.c
index a57570b..a91b1c0 100644
--- a/common/usb_storage.c
+++ b/common/usb_storage.c
@@ -964,7 +964,7 @@ static void usb_stor_set_max_xfer_blk(struct usb_device *udev,
 		blk = 20;
 	} else {
 		if (size > USHRT_MAX * 512)
-			blk = USHRT_MAX;
+			size = USHRT_MAX * 512;
 		blk = size / 512;
 	}
 #endif
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2017-10-01 18:41 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-09-28  4:50 [U-Boot] [PATCH] usb: storage: Fix overwritten in usb_stor_set_max_xfer_blk() Bin Meng
2017-09-28 15:24 ` Marek Vasut
2017-09-28 23:36   ` Bin Meng
2017-09-29  2:30     ` Marek Vasut
2017-09-29  9:26       ` Bin Meng
2017-09-29  9:36         ` Marek Vasut
2017-10-01 13:18           ` Bin Meng
2017-10-01 18:41             ` Marek Vasut

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.