Skip to content

Commit 7fbcd19

Browse files
Dan Carpentergregkh
authored andcommitted
usb: fotg210-hcd: delete an incorrect bounds test
Here "temp" is the number of characters that we have written and "size" is the size of the buffer. The intent was clearly to say that if we have written to the end of the buffer then stop. However, for that to work the comparison should have been done on the original "size" value instead of the "size -= temp" value. Not only will that not trigger when we want to, but there is a small chance that it will trigger incorrectly before we want it to and we break from the loop slightly earlier than intended. This code was recently changed from using snprintf() to scnprintf(). With snprintf() we likely would have continued looping and passed a negative size parameter to snprintf(). This would have triggered an annoying WARN(). Now that we have converted to scnprintf() "size" will never drop below 1 and there is no real need for this test. We could change the condition to "if (temp <= 1) goto done;" but just deleting the test is cleanest. Fixes: 7d50195 ("usb: host: Faraday fotg210-hcd driver") Cc: stable <stable@kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Lee Jones <lee@kernel.org> Link: https://lore.kernel.org/r/ZXmwIwHe35wGfgzu@suswa Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 772685c commit 7fbcd19

File tree

1 file changed

+0
-3
lines changed

1 file changed

+0
-3
lines changed

drivers/usb/fotg210/fotg210-hcd.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -428,8 +428,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh,
428428
temp = size;
429429
size -= temp;
430430
next += temp;
431-
if (temp == size)
432-
goto done;
433431
}
434432

435433
temp = snprintf(next, size, "\n");
@@ -439,7 +437,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh,
439437
size -= temp;
440438
next += temp;
441439

442-
done:
443440
*sizep = size;
444441
*nextp = next;
445442
}

0 commit comments

Comments
 (0)