From d5ce1379be9c79d4bcf201c20c5cc87bb2bc973c Mon Sep 17 00:00:00 2001 From: Eric Sesterhenn <snakebyte@gmx.de> Date: Thu, 1 Jun 2006 20:48:45 -0700 Subject: [PATCH] [PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c From: Eric Sesterhenn <snakebyte@gmx.de> This fixes coverity Bug #390. With the following code ret = ep->branch = balance(isp116x, ep->period, ep->load); if (ret < 0) goto fail; the problem is that ret and balance are of the type int, and ep->branch is u16. so the int balance() returns gets reduced to u16 and then converted to an int again, which removes the sign. Maybe the following little c program can explain it better: --- drivers/usb/host/isp116x-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c index e99210b7909b3f..c5e224048efa89 100644 --- a/drivers/usb/host/isp116x-hcd.c +++ b/drivers/usb/host/isp116x-hcd.c @@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd, if (ep->branch < PERIODIC_SIZE) break; - ret = ep->branch = balance(isp116x, ep->period, ep->load); + ep->branch = ret = balance(isp116x, ep->period, ep->load); if (ret < 0) goto fail; ret = 0; -- GitLab