| From bfd08d06d978d0304eb6f7855b548aa2cd1c5486 Mon Sep 17 00:00:00 2001 |
| From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> |
| Date: Wed, 26 Aug 2020 22:21:19 +0300 |
| Subject: USB: gadget: u_f: Unbreak offset calculation in VLAs |
| |
| From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> |
| |
| commit bfd08d06d978d0304eb6f7855b548aa2cd1c5486 upstream. |
| |
| Inadvertently the commit b1cd1b65afba ("USB: gadget: u_f: add overflow checks |
| to VLA macros") makes VLA macros to always return 0 due to different scope of |
| two variables of the same name. Obviously we need to have only one. |
| |
| Fixes: b1cd1b65afba ("USB: gadget: u_f: add overflow checks to VLA macros") |
| Reported-by: Marek Szyprowski <m.szyprowski@samsung.com> |
| Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> |
| Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> |
| Cc: Brooke Basile <brookebasile@gmail.com> |
| Cc: stable <stable@kernel.org> |
| Link: https://lore.kernel.org/r/20200826192119.56450-1-andriy.shevchenko@linux.intel.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/gadget/u_f.h | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/usb/gadget/u_f.h |
| +++ b/drivers/usb/gadget/u_f.h |
| @@ -28,9 +28,9 @@ |
| size_t offset = 0; \ |
| if (groupname##__next != SIZE_MAX) { \ |
| size_t align_mask = __alignof__(type) - 1; \ |
| - size_t offset = (groupname##__next + align_mask) \ |
| - & ~align_mask; \ |
| size_t size = array_size(n, sizeof(type)); \ |
| + offset = (groupname##__next + align_mask) & \ |
| + ~align_mask; \ |
| if (check_add_overflow(offset, size, \ |
| &groupname##__next)) { \ |
| groupname##__next = SIZE_MAX; \ |
| @@ -46,8 +46,8 @@ |
| size_t offset = 0; \ |
| if (groupname##__next != SIZE_MAX) { \ |
| size_t align_mask = __alignof__(type) - 1; \ |
| - size_t offset = (groupname##__next + align_mask) \ |
| - & ~align_mask; \ |
| + offset = (groupname##__next + align_mask) & \ |
| + ~align_mask; \ |
| if (check_add_overflow(offset, groupname##_##name##__sz,\ |
| &groupname##__next)) { \ |
| groupname##__next = SIZE_MAX; \ |
