openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

usb: gadget: f_fs: refactor and document __ffs_ep0_read_events better 

Instead of using variable length array, use a static length equal to
the size of the ffs->ev.types array.  This gets rid of a sparse warning:

	drivers/usb/gadget/function/f_fs.c:401:44: warning:
	Variable length array is used.

and makes it more explicit that the array has a very tight upper size
limit.  Also add some more documentation about the ev.types array and
how its size is limited and affects the rest of the code.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Rohith Seelaboyina <rseelaboyina@nvidia.com>
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
This commit is contained in:
Michal Nazarewicz 2014-09-10 17:50:24 +02:00 committed by Felipe Balbi
parent a7657a93d6
commit 67913bbd0b
1 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/usb/gadget/function/f_fs.c
View File

@ -390,17 +390,20 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
return ret; return ret;
} }
/* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf, static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
size_t n) size_t n)
{ {
/* /*
* We are holding ffs->ev.waitq.lock and ffs->mutex and we need * n cannot be bigger than ffs->ev.count, which cannot be bigger than
* to release them. * size of ffs->ev.types array (which is four) so that's how much space
* we reserve.
*/ */
struct usb_functionfs_event events[n]; struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
const size_t size = n * sizeof *events;
unsigned i = 0; unsigned i = 0;
memset(events, 0, sizeof events); memset(events, 0, size);
do { do {
events[i].type = ffs->ev.types[i]; events[i].type = ffs->ev.types[i];
@ -410,19 +413,15 @@ static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
} }
} while (++i < n); } while (++i < n);
if (n < ffs->ev.count) { ffs->ev.count -= n;
ffs->ev.count -= n; if (ffs->ev.count)
memmove(ffs->ev.types, ffs->ev.types + n, memmove(ffs->ev.types, ffs->ev.types + n,
ffs->ev.count * sizeof *ffs->ev.types); ffs->ev.count * sizeof *ffs->ev.types);
} else {
ffs->ev.count = 0;
}
spin_unlock_irq(&ffs->ev.waitq.lock); spin_unlock_irq(&ffs->ev.waitq.lock);
mutex_unlock(&ffs->mutex); mutex_unlock(&ffs->mutex);
return unlikely(__copy_to_user(buf, events, sizeof events)) return unlikely(__copy_to_user(buf, events, size)) ? -EFAULT : size;
? -EFAULT : sizeof events;
} }
static ssize_t ffs_ep0_read(struct file *file, char __user *buf, static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
@ -2377,6 +2376,13 @@ static void __ffs_event_add(struct ffs_data *ffs,
if (ffs->setup_state == FFS_SETUP_PENDING) if (ffs->setup_state == FFS_SETUP_PENDING)
ffs->setup_state = FFS_SETUP_CANCELLED; ffs->setup_state = FFS_SETUP_CANCELLED;
/*
* Logic of this function guarantees that there are at most four pending
* evens on ffs->ev.types queue. This is important because the queue
* has space for four elements only and __ffs_ep0_read_events function
* depends on that limit as well. If more event types are added, those
* limits have to be revisited or guaranteed to still hold.
*/
switch (type) { switch (type) {
case FUNCTIONFS_RESUME: case FUNCTIONFS_RESUME:
rem_type2 = FUNCTIONFS_SUSPEND; rem_type2 = FUNCTIONFS_SUSPEND;