From 5c13155d190464fade0344e16b6341f18af25f1f Mon Sep 17 00:00:00 2001 From: Andrey Shvetsov Date: Fri, 7 Apr 2017 15:38:39 +0200 Subject: [PATCH] staging: most: usb: fix size overflow Despite the user payload may not be bigger than (2**16 - 1) bytes, the final packet size may be bigger because of the gap space needed for the controller. This patch removes the temporary variables of the type u16 that are used to hold the offsets that may be bigger than 2**16 bytes. Signed-off-by: Andrey Shvetsov Signed-off-by: Christian Gromm Signed-off-by: Greg Kroah-Hartman --- drivers/staging/most/hdm-usb/hdm_usb.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/staging/most/hdm-usb/hdm_usb.c b/drivers/staging/most/hdm-usb/hdm_usb.c index 6e94ee2b4fb3..ad907e9c59bb 100644 --- a/drivers/staging/most/hdm-usb/hdm_usb.c +++ b/drivers/staging/most/hdm-usb/hdm_usb.c @@ -281,7 +281,6 @@ static int hdm_add_padding(struct most_dev *mdev, int channel, struct mbo *mbo) struct most_channel_config *conf = &mdev->conf[channel]; unsigned int frame_size = get_stream_frame_size(conf); unsigned int j, num_frames; - u16 rd_addr, wr_addr; if (!frame_size) return -EIO; @@ -293,13 +292,10 @@ static int hdm_add_padding(struct most_dev *mdev, int channel, struct mbo *mbo) return -EIO; } - for (j = 1; j < num_frames; j++) { - wr_addr = (num_frames - j) * USB_MTU; - rd_addr = (num_frames - j) * frame_size; - memmove(mbo->virt_address + wr_addr, - mbo->virt_address + rd_addr, + for (j = num_frames - 1; j > 0; j--) + memmove(mbo->virt_address + j * USB_MTU, + mbo->virt_address + j * frame_size, frame_size); - } mbo->buffer_length = num_frames * USB_MTU; return 0; } -- 2.39.5