diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2011-09-27 09:20:50 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2011-09-29 13:23:33 -0700 |
| commit | 53d785ccd918d571c227d459477793872676fc02 (patch) | |
| tree | 538c8f731207bf916aad708b5c39f03b9ab58c55 /drivers/tty | |
| parent | tty/n_gsm: avoid fifo overflow in gsm_dlci_data_output (diff) | |
| download | linux-dev-53d785ccd918d571c227d459477793872676fc02.tar.xz linux-dev-53d785ccd918d571c227d459477793872676fc02.zip | |
TTY: snyclinkmp: forever loop in tx_load_dma_buffer()
My main concern here was the line that said:
copy_count = min_t(unsigned short,count,SCABUFSIZE);
"count" is an unsigned int here so the cast to unsigned short
truncates the upper bits. So if count is 0x10000 then copy_count is
0 and the loop never exits.
"count" comes from skb->len in hdlcdev_xmit().
The other min_t() changes are just cleanups.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/tty')
| -rw-r--r-- | drivers/tty/synclinkmp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c index c77831c7675a..0f6b796c95c5 100644 --- a/drivers/tty/synclinkmp.c +++ b/drivers/tty/synclinkmp.c @@ -4950,7 +4950,7 @@ CheckAgain: if ( debug_level >= DEBUG_LEVEL_DATA ) trace_block(info,info->rx_buf_list_ex[StartIndex].virt_addr, - min_t(int, framesize,SCABUFSIZE),0); + min_t(unsigned int, framesize, SCABUFSIZE), 0); if (framesize) { if (framesize > info->max_frame_size) @@ -5015,14 +5015,14 @@ static void tx_load_dma_buffer(SLMP_INFO *info, const char *buf, unsigned int co SCADESC_EX *desc_ex; if ( debug_level >= DEBUG_LEVEL_DATA ) - trace_block(info,buf, min_t(int, count,SCABUFSIZE), 1); + trace_block(info, buf, min_t(unsigned int, count, SCABUFSIZE), 1); /* Copy source buffer to one or more DMA buffers, starting with * the first transmit dma buffer. */ for(i=0;;) { - copy_count = min_t(unsigned short,count,SCABUFSIZE); + copy_count = min_t(unsigned int, count, SCABUFSIZE); desc = &info->tx_buf_list[i]; desc_ex = &info->tx_buf_list_ex[i]; |