Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: b2c2: flexcop-usb: fix flexcop_usb_memory_req

smatch generated this warning:

drivers/media/usb/b2c2/flexcop-usb.c:199 flexcop_usb_memory_req() warn: iterator 'i' not incremented

and indeed the function is not using i or updating buf.

The reason this always worked is that this function is called to write just
6 bytes (a MAC address) to the USB device, and so in practice there is only
a single chunk written. If we ever would need to write more than one chunk,
this function would fail since each chunk would read from or write to the
same buf address.

Rewrite the function to properly handle this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

+4 -3
+4 -3
drivers/media/usb/b2c2/flexcop-usb.c
··· 179 179 flexcop_usb_request_t req, flexcop_usb_mem_page_t page_start, 180 180 u32 addr, int extended, u8 *buf, u32 len) 181 181 { 182 - int i, ret = 0; 182 + int ret = 0; 183 183 u16 wMax; 184 184 u32 pagechunk = 0; 185 185 ··· 196 196 default: 197 197 return -EINVAL; 198 198 } 199 - for (i = 0; i < len;) { 199 + while (len) { 200 200 pagechunk = min(wMax, bytes_left_to_read_on_page(addr, len)); 201 201 deb_info("%x\n", 202 202 (addr & V8_MEMORY_PAGE_MASK) | ··· 206 206 page_start + (addr / V8_MEMORY_PAGE_SIZE), 207 207 (addr & V8_MEMORY_PAGE_MASK) | 208 208 (V8_MEMORY_EXTENDED*extended), 209 - &buf[i], pagechunk); 209 + buf, pagechunk); 210 210 211 211 if (ret < 0) 212 212 return ret; 213 213 addr += pagechunk; 214 + buf += pagechunk; 214 215 len -= pagechunk; 215 216 } 216 217 return 0;