Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 67913bbd authored by Michal Nazarewicz's avatar Michal Nazarewicz Committed by Felipe Balbi
Browse files

usb: gadget: f_fs: refactor and document __ffs_ep0_read_events better 



Instead of using variable length array, use a static length equal to
the size of the ffs->ev.types array.  This gets rid of a sparse warning:

	drivers/usb/gadget/function/f_fs.c:401:44: warning:
	Variable length array is used.

and makes it more explicit that the array has a very tight upper size
limit.  Also add some more documentation about the ev.types array and
how its size is limited and affects the rest of the code.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reported-by: default avatarRohith Seelaboyina <rseelaboyina@nvidia.com>
Signed-off-by: default avatarMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent a7657a93

drivers/usb/gadget/function/f_fs.c

+17 −11
Original line number Diff line number Diff line
@@ -390,17 +390,20 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, 
	return ret;

}



/* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */

static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,

				     size_t n)

{

	/*

	 * We are holding ffs->ev.waitq.lock and ffs->mutex and we need

	 * to release them.

	 * n cannot be bigger than ffs->ev.count, which cannot be bigger than

	 * size of ffs->ev.types array (which is four) so that's how much space

	 * we reserve.

	 */

	struct usb_functionfs_event events[n];

	struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];

	const size_t size = n * sizeof *events;

	unsigned i = 0;



	memset(events, 0, sizeof events);

	memset(events, 0, size);



	do {

		events[i].type = ffs->ev.types[i];
@@ -410,19 +413,15 @@ static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf, 
		}

	} while (++i < n);



	if (n < ffs->ev.count) {

	ffs->ev.count -= n;

	if (ffs->ev.count)

		memmove(ffs->ev.types, ffs->ev.types + n,

			ffs->ev.count * sizeof *ffs->ev.types);

	} else {

		ffs->ev.count = 0;

	}



	spin_unlock_irq(&ffs->ev.waitq.lock);

	mutex_unlock(&ffs->mutex);



	return unlikely(__copy_to_user(buf, events, sizeof events))

		? -EFAULT : sizeof events;

	return unlikely(__copy_to_user(buf, events, size)) ? -EFAULT : size;

}



static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
@@ -2377,6 +2376,13 @@ static void __ffs_event_add(struct ffs_data *ffs, 
	if (ffs->setup_state == FFS_SETUP_PENDING)

		ffs->setup_state = FFS_SETUP_CANCELLED;



	/*

	 * Logic of this function guarantees that there are at most four pending

	 * evens on ffs->ev.types queue.  This is important because the queue

	 * has space for four elements only and __ffs_ep0_read_events function

	 * depends on that limit as well.  If more event types are added, those

	 * limits have to be revisited or guaranteed to still hold.

	 */

	switch (type) {

	case FUNCTIONFS_RESUME:

		rem_type2 = FUNCTIONFS_SUSPEND;