From: Eric Sesterhenn <snakebyte@gmx.de>
Date: Fri, 2 Jun 2006 03:48:45 +0000 (-0700)
Subject: [PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c
X-Git-Tag: v2.6.18-rc1~858^2~49
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=d5ce1379be9c79d4bcf201c20c5cc87bb2bc973c;p=linux-2.6-omap-h63xx.git

[PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c

From: Eric Sesterhenn <snakebyte@gmx.de>

This fixes coverity Bug #390.

With the following code

	ret = ep->branch = balance(isp116x, ep->period, ep->load);
	if (ret < 0)
		goto fail;

the problem is that ret and balance are of the type int, and ep->branch is u16.
so the int balance() returns gets reduced to u16 and then converted to an int again,
which removes the sign. Maybe the following little c program can explain it better:
---

diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index e99210b7909..c5e224048ef 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
 		if (ep->branch < PERIODIC_SIZE)
 			break;
 
-		ret = ep->branch = balance(isp116x, ep->period, ep->load);
+		ep->branch = ret = balance(isp116x, ep->period, ep->load);
 		if (ret < 0)
 			goto fail;
 		ret = 0;