ALSA: vx: Fix possible transfer overflow

[mirror_ubuntu-bionic-kernel.git] / sound / pcmcia / vx / vxp_ops.c

diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c
index 281972913c32140939c087067f4340d6882e6626..56aa1ba73ccc1ccb488bc662aa7ad459213eb696 100644 (file)
--- a/sound/pcmcia/vx/vxp_ops.c
+++ b/sound/pcmcia/vx/vxp_ops.c
@@ -369,12 +369,12 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        unsigned short *addr = (unsigned short *)(runtime->dma_area + offset);
 
        vx_setup_pseudo_dma(chip, 1);
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 1; /* in 16bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0) {
+               for (; length > 0; length--) {
                        outw(cpu_to_le16(*addr), port);
                        addr++;
                }
@@ -384,7 +384,7 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 1; /* in 16bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 0) {
+       for (; count > 0; count--) {
                outw(cpu_to_le16(*addr), port);
                addr++;
        }
@@ -411,12 +411,12 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        if (snd_BUG_ON(count % 2))
                return;
        vx_setup_pseudo_dma(chip, 0);
-       if (offset + count > pipe->buffer_bytes) {
+       if (offset + count >= pipe->buffer_bytes) {
                int length = pipe->buffer_bytes - offset;
                count -= length;
                length >>= 1; /* in 16bit words */
                /* Transfer using pseudo-dma. */
-               while (length-- > 0)
+               for (; length > 0; length--)
                        *addr++ = le16_to_cpu(inw(port));
                addr = (unsigned short *)runtime->dma_area;
                pipe->hw_ptr = 0;
@@ -424,7 +424,7 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime,
        pipe->hw_ptr += count;
        count >>= 1; /* in 16bit words */
        /* Transfer using pseudo-dma. */
-       while (count-- > 1)
+       for (; count > 1; count--)
                *addr++ = le16_to_cpu(inw(port));
        /* Disable DMA */
        pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;