ALSA: vx: Fix possible transfer overflow

[mirror_ubuntu-artful-kernel.git] / sound / pci / vx222 / vx222_ops.c

diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index af83b3b380523e75c897695a292bfecbdb2734fb..8e457ea27f8918e13a5e949d7ee243503b2f294f 100644 (file)
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -269,12 +269,12 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
 
        /* Transfer using pseudo-dma.
         */
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 2; /* in 32bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0) {
+               for (; length > 0; length--) {
                        outl(cpu_to_le32(*addr), port);
                        addr++;
                }
@@ -284,7 +284,7 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 2; /* in 32bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0) {
+       for (; count > 0; count--) {
                outl(cpu_to_le32(*addr), port);
                addr++;
        }
@@ -307,12 +307,12 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        vx2_setup_pseudo_dma(chip, 0);
        /* Transfer using pseudo-dma.
         */
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 2; /* in 32bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0)
+               for (; length > 0; length--)
                        *addr++ = le32_to_cpu(inl(port));
                addr = (u32 *)runtime->dma_area;
                pipe->hw_ptr = 0;
@@ -320,7 +320,7 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 2; /* in 32bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0)
+       for (; count > 0; count--)
                *addr++ = le32_to_cpu(inl(port));
 
        vx2_release_pseudo_dma(chip);