From: Matthijs Kooijman Date: Fri, 30 Aug 2013 16:45:12 +0000 (+0200) Subject: staging: dwc2: fix off-by-one in check for max_packet_count parameter X-Git-Tag: firefly_0821_release~176^2~5471^2~11 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=3b9edf88472e9259f9361aa485a1f399e54c4c77;p=firefly-linux-kernel-4.4.55.git staging: dwc2: fix off-by-one in check for max_packet_count parameter Previously, the max_packet_count could be set to 1 << x, where x is the number of bits available (width + 4 in the code). Since 1 << x requires x + 1 bits to represent, this will not work. The real maximum value is (1 << x) - 1. This value is already used the default when the set value is invalid, but the upper limit for the set value was off-by-one. This change makes the check the same as the one for max_transfer_size, which was already correct. Signed-off-by: Matthijs Kooijman Acked-by: Paul Zimmerman Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/dwc2/core.c b/drivers/staging/dwc2/core.c index a090f79bb5f5..5f09f47bdf73 100644 --- a/drivers/staging/dwc2/core.c +++ b/drivers/staging/dwc2/core.c @@ -2209,7 +2209,7 @@ int dwc2_set_param_max_packet_count(struct dwc2_hsotg *hsotg, int val) GHWCFG3_PACKET_SIZE_CNTR_WIDTH_MASK >> GHWCFG3_PACKET_SIZE_CNTR_WIDTH_SHIFT; - if (val < 15 || val > (1 << (width + 4))) + if (val < 15 || val >= (1 << (width + 4))) valid = 0; if (!valid) {