On Mon, Feb 16, 2015 at 10:18:01AM +0000, Ian Abbott wrote:>>> On Sun, Feb 15, 2015 at 10:30:22AM +0000, Ian Abbott wrote:
On 16/02/15 04:13, Mark Brown wrote:
The check against INT_MAX is there because a struct spi_ioc_transfer might
have rx_buf==NULL, tx_buf==NULL and len!=0, in which case it would no longer
use up space in either of the pre-allocated buffers so neither rx_total nor
tx_total would increase. Checking the sum of the len fields against INT_MAX
prevents arithmetic overflow in the return value of the function.
If that's what the code is supposed to do then someone reading the code
needs to be able to tell that without too much effort, I'd not expect
that to be possible as things are. Maintainability is very important.
There was a whole paragraph about that in the commit message, but maybe it
was too concise.
The commit message is not the code. The code itself needs to be clear,
and even based on what's in the commit message it's not terribly obvious
(and with the above the return value that will be overflowed doesn't