From 72ac8f3fc29016a31ee309b4d025b487e78906ab Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Wed, 27 Sep 2017 21:50:07 -0700 Subject: usb: storage: Fix overwritten in usb_stor_set_max_xfer_blk() The stored 'blk' value is overwritten to 'size / 512' before it can be used in usb_stor_set_max_xfer_blk(). This is not what we want. In fact, when 'size' exceeds the upper limit (USHRT_MAX * 512), we should simply assign 'size' to the upper limit. Reported-by: Coverity (CID: 167250) Signed-off-by: Bin Meng --- common/usb_storage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'common') diff --git a/common/usb_storage.c b/common/usb_storage.c index a57570b73f..a91b1c0d2f 100644 --- a/common/usb_storage.c +++ b/common/usb_storage.c @@ -964,7 +964,7 @@ static void usb_stor_set_max_xfer_blk(struct usb_device *udev, blk = 20; } else { if (size > USHRT_MAX * 512) - blk = USHRT_MAX; + size = USHRT_MAX * 512; blk = size / 512; } #endif -- cgit