At the end of qtd_fill(), we assign the 'int count' variable to the 'size_t
length' field of 'struct ehci_qtd'. In order not to mix the *signed* and
*unsigned* values let's make that variable and the function's result 'u16'
as qTD's maximum length is a 15-bit quantity anyway...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
Signed-off-by: Sergey Shtylyov <s.shtylyov@xxxxxx>
---
This patch is against the 'usb-next' branch of Greg KH's 'usb.git' repo.
drivers/usb/host/ehci-q.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
Index: usb/drivers/usb/host/ehci-q.c
===================================================================
--- usb.orig/drivers/usb/host/ehci-q.c
+++ usb/drivers/usb/host/ehci-q.c
@@ -33,12 +33,13 @@
/* fill a qtd, returning how much of the buffer we were able to queue up */
-static int
+static u16
qtd_fill(struct ehci_hcd *ehci, struct ehci_qtd *qtd, dma_addr_t buf,
size_t len, int token, int maxpacket)
{
- int i, count;
u64 addr = buf;
+ u16 count;
+ int i;
/* one buffer entry per 4K ... first might be short or unaligned */
qtd->hw_buf[0] = cpu_to_hc32(ehci, (u32)addr);
