From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Marek Szyprowski <m.szyprowski@samsung.com>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Brooke Basile <brookebasile@gmail.com>,
stable <stable@kernel.org>
Subject: [PATCH 4.14 85/91] USB: gadget: u_f: Unbreak offset calculation in VLAs
Date: Tue, 1 Sep 2020 17:10:59 +0200 [thread overview]
Message-ID: <20200901150932.386937578@linuxfoundation.org> (raw)
In-Reply-To: <20200901150928.096174795@linuxfoundation.org>
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit bfd08d06d978d0304eb6f7855b548aa2cd1c5486 upstream.
Inadvertently the commit b1cd1b65afba ("USB: gadget: u_f: add overflow checks
to VLA macros") makes VLA macros to always return 0 due to different scope of
two variables of the same name. Obviously we need to have only one.
Fixes: b1cd1b65afba ("USB: gadget: u_f: add overflow checks to VLA macros")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Brooke Basile <brookebasile@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20200826192119.56450-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/u_f.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/u_f.h
+++ b/drivers/usb/gadget/u_f.h
@@ -28,9 +28,9 @@
size_t offset = 0; \
if (groupname##__next != SIZE_MAX) { \
size_t align_mask = __alignof__(type) - 1; \
- size_t offset = (groupname##__next + align_mask) \
- & ~align_mask; \
size_t size = array_size(n, sizeof(type)); \
+ offset = (groupname##__next + align_mask) & \
+ ~align_mask; \
if (check_add_overflow(offset, size, \
&groupname##__next)) { \
groupname##__next = SIZE_MAX; \
@@ -46,8 +46,8 @@
size_t offset = 0; \
if (groupname##__next != SIZE_MAX) { \
size_t align_mask = __alignof__(type) - 1; \
- size_t offset = (groupname##__next + align_mask) \
- & ~align_mask; \
+ offset = (groupname##__next + align_mask) & \
+ ~align_mask; \
if (check_add_overflow(offset, groupname##_##name##__sz,\
&groupname##__next)) { \
groupname##__next = SIZE_MAX; \
next prev parent reply other threads:[~2020-09-01 17:01 UTC|newest]
Thread overview: 95+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-01 15:09 [PATCH 4.14 00/91] 4.14.196-rc1 review Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 01/91] powerpc/64s: Dont init FSCR_DSCR in __init_FSCR() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 02/91] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 03/91] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 04/91] ipvlan: fix device features Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 05/91] gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 06/91] ALSA: pci: delete repeated words in comments Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 07/91] ASoC: tegra: Fix reference count leaks Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 08/91] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 09/91] arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 10/91] powerpc/xive: Ignore kmemleak false positives Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 11/91] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 12/91] blktrace: ensure our debugfs dir exists Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 13/91] scsi: target: tcmu: Fix crash on ARM during cmd completion Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 14/91] iommu/iova: Dont BUG on invalid PFNs Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 15/91] drm/amdkfd: Fix reference count leaks Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 16/91] drm/radeon: fix multiple reference count leak Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 17/91] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 18/91] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 19/91] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 20/91] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 21/91] scsi: lpfc: Fix shost refcount mismatch when deleting vport Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 22/91] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 23/91] omapfb: fix multiple reference count leaks due to pm_runtime_get_sync Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 24/91] PCI: Fix pci_create_slot() reference count leak Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.14 25/91] rtlwifi: rtl8192cu: Prevent leaking urb Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 26/91] mips/vdso: Fix resource leaks in genvdso.c Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 27/91] cec-api: prevent leaking memory through hole in structure Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 28/91] f2fs: fix use-after-free issue Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 29/91] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 30/91] drm/nouveau: Fix reference count leak in nouveau_connector_detect Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 31/91] locking/lockdep: Fix overflow in presentation of average lock-time Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 32/91] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 33/91] ceph: fix potential mdsc use-after-free crash Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 34/91] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 35/91] EDAC/ie31200: Fallback if host bridge device is already initialized Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 36/91] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 37/91] KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 38/91] powerpc/spufs: add CONFIG_COREDUMP dependency Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 39/91] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 40/91] efi: provide empty efi_enter_virtual_mode implementation Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 41/91] Revert "ath10k: fix DMA related firmware crashes on multiple devices" Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 42/91] media: gpio-ir-tx: improve precision of transmitted signal due to scheduling Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 43/91] nvme-fc: Fix wrong return value in __nvme_fc_init_request() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 44/91] null_blk: fix passing of REQ_FUA flag in null_handle_rq Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 45/91] i2c: rcar: in slave mode, clear NACK earlier Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 46/91] usb: gadget: f_tcm: Fix some resource leaks in some error paths Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 47/91] jbd2: make sure jh have b_transaction set in refile/unfile_buffer Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 48/91] ext4: dont BUG on inconsistent journal feature Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 49/91] jbd2: abort journal if free a async write error metadata buffer Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 50/91] fs: prevent BUG_ON in submit_bh_wbc() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 51/91] spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 52/91] s390/cio: add cond_resched() in the slow_eval_known_fn() loop Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 53/91] scsi: ufs: Fix possible infinite loop in ufshcd_hold Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 54/91] scsi: ufs: Improve interrupt handling for shared interrupts Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 55/91] scsi: ufs: Clean up completed request without interrupt notification Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 56/91] net: gianfar: Add of_node_put() before goto statement Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 57/91] powerpc/perf: Fix soft lockups due to missed interrupt accounting Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 58/91] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 59/91] btrfs: fix space cache memory leak after transaction abort Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 60/91] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 61/91] USB: lvtest: return proper error code in probe Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 62/91] vt: defer kfree() of vc_screenbuf in vc_do_resize() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 63/91] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 64/91] serial: samsung: Removes the IRQ not found warning Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 65/91] serial: pl011: Fix oops on -EPROBE_DEFER Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 66/91] serial: pl011: Dont leak amba_ports entry on driver register error Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 67/91] serial: 8250_exar: Fix number of ports for Commtech PCIe cards Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 68/91] serial: 8250: change lock order in serial8250_do_startup() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 69/91] writeback: Protect inode->i_io_list with inode->i_lock Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 70/91] writeback: Avoid skipping inode writeback Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 71/91] writeback: Fix sync livelock due to b_dirty_time processing Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 72/91] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 73/91] xhci: Do warm-reset when both CAS and XDEV_RESUME are set Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 74/91] PM: sleep: core: Fix the handling of pending runtime resume requests Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 75/91] device property: Fix the secondary firmware node handling in set_primary_fwnode() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 76/91] drm/amdgpu: Fix buffer overflow in INFO ioctl Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 77/91] USB: yurex: Fix bad gfp argument Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 78/91] usb: uas: Add quirk for PNY Pro Elite Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 79/91] USB: quirks: Add no-lpm quirk for another Raydium touchscreen Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 80/91] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 81/91] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 82/91] overflow.h: Add allocation size calculation helpers Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 83/91] USB: gadget: u_f: add overflow checks to VLA macros Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.14 84/91] USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() Greg Kroah-Hartman
2020-09-01 15:10 ` Greg Kroah-Hartman [this message]
2020-09-01 15:11 ` [PATCH 4.14 86/91] USB: cdc-acm: rework notification_buffer resizing Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.14 87/91] usb: storage: Add unusual_uas entry for Sony PSZ drives Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.14 88/91] btrfs: check the right error variable in btrfs_del_dir_entries_in_log Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.14 89/91] tpm: Unify the mismatching TPM space buffer sizes Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.14 90/91] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
2020-09-01 15:11 ` [PATCH 4.14 91/91] ALSA: usb-audio: Update documentation comment for MS2109 quirk Greg Kroah-Hartman
2020-09-01 22:22 ` [PATCH 4.14 00/91] 4.14.196-rc1 review Shuah Khan
2020-09-02 7:13 ` Naresh Kamboju
2020-09-02 16:46 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200901150932.386937578@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=brookebasile@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).