USB: more u32 conversion after transfer_buffer_length and actual_length
transfer_buffer_length and actual_length have become unsigned, therefore some
additional conversion of local variables, function arguments and print
specifications is desired.
A test for a negative urb->transfer_buffer_length became obsolete; instead
we ensure that it does not exceed INT_MAX. Also, urb->actual_length is always
less than urb->transfer_buffer_length.
rh_string() does no longer return -EPIPE in the case of an unsupported ID.
Instead its only caller, rh_call_control() does the check.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index 7025d80..3376055 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -370,7 +370,7 @@
}
/* the I/O buffer must be mapped/unmapped, except when length=0 */
- if (urb->transfer_buffer_length < 0)
+ if (urb->transfer_buffer_length > INT_MAX)
return -EMSGSIZE;
#ifdef DEBUG