From: Bin Meng <bmeng.cn@gmail.com>
Date: Thu, 28 Sep 2017 04:50:07 +0000 (-0700)
Subject: usb: storage: Fix overwritten in usb_stor_set_max_xfer_blk()
X-Git-Tag: v2017.11-rc1~2^2~1
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=72ac8f3fc29016a31ee309b4d025b487e78906ab;p=oweals%2Fu-boot.git

usb: storage: Fix overwritten in usb_stor_set_max_xfer_blk()

The stored 'blk' value is overwritten to 'size / 512' before it can
be used in usb_stor_set_max_xfer_blk(). This is not what we want.
In fact, when 'size' exceeds the upper limit (USHRT_MAX * 512), we
should simply assign 'size' to the upper limit.

Reported-by: Coverity (CID: 167250)
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
---

diff --git a/common/usb_storage.c b/common/usb_storage.c
index a57570b73f..a91b1c0d2f 100644
--- a/common/usb_storage.c
+++ b/common/usb_storage.c
@@ -964,7 +964,7 @@ static void usb_stor_set_max_xfer_blk(struct usb_device *udev,
 		blk = 20;
 	} else {
 		if (size > USHRT_MAX * 512)
-			blk = USHRT_MAX;
+			size = USHRT_MAX * 512;
 		blk = size / 512;
 	}
 #endif