Hi, On 2018年07月25日 22:57, Mauro Carvalho Chehab wrote: ... > There was another patch proposed to fix this issue with does the > right thing when rlen == 0. I rebased it on the top of the current > tree: > https://git.linuxtv.org/media_tree.git/commit/?id=0b666e1c8120c0b17a8a68aaed58e22011f06ab3 > > That should cover both cases. When wlen is checked to be <= 2 and wbuf[0],wbuf[1] are already used in 'index','value', why this patch copys wbuf and passes it again in usb_control_msg when wo==1 ? (just to silence static analiyzers?) Furthermore, I am afraid that a static analyzer might warn on a possible buffer overrun in usb_control_msg in the case of rbuf == NULL && rlen > 2, since buf's length is passed as rlen but is actually wlen. regards, Akihiro
