Importing "grsecurity-3.1-3.19.2-201503201903.patch"

[people/ms/linux.git] / drivers / usb / core / devio.c

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e500243803d87b1b3882acb5d37670af48f43f1b..401300f0f36f2f53de2fedb02ad7f6f2c114a7c6 100644 (file)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -187,7 +187,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
        struct usb_dev_state *ps = file->private_data;
        struct usb_device *dev = ps->dev;
        ssize_t ret = 0;
-       unsigned len;
+       size_t len;
        loff_t pos;
        int i;
 
@@ -229,22 +229,22 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
        for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
                struct usb_config_descriptor *config =
                        (struct usb_config_descriptor *)dev->rawdescriptors[i];
-               unsigned int length = le16_to_cpu(config->wTotalLength);
+               size_t length = le16_to_cpu(config->wTotalLength);
 
                if (*ppos < pos + length) {
 
                        /* The descriptor may claim to be longer than it
                         * really is.  Here is the actual allocated length. */
-                       unsigned alloclen =
+                       size_t alloclen =
                                le16_to_cpu(dev->config[i].desc.wTotalLength);
 
-                       len = length - (*ppos - pos);
+                       len = length + pos - *ppos;
                        if (len > nbytes)
                                len = nbytes;
 
                        /* Simply don't write (skip over) unallocated parts */
                        if (alloclen > (*ppos - pos)) {
-                               alloclen -= (*ppos - pos);
+                               alloclen = alloclen + pos - *ppos;
                                if (copy_to_user(buf,
                                    dev->rawdescriptors[i] + (*ppos - pos),
                                    min(len, alloclen))) {