summaryrefslogtreecommitdiffstats
path: root/drivers/usb/gadget/function/f_fs.c
diff options
context:
space:
mode:
authorDean Anderson <dean@sensoray.com>2021-03-17 15:41:09 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2021-03-23 12:50:03 +0100
commit55b74ce7d2ce0b0058f3e08cab185a0afacfe39e (patch)
tree6320de7f510ea1e721db94df5d135950dfe120f8 /drivers/usb/gadget/function/f_fs.c
parent84770f028fabab4cb66188d583ed12652f30576b (diff)
downloadlinux-55b74ce7d2ce0b0058f3e08cab185a0afacfe39e.tar.gz
linux-55b74ce7d2ce0b0058f3e08cab185a0afacfe39e.tar.bz2
linux-55b74ce7d2ce0b0058f3e08cab185a0afacfe39e.zip
usb: gadget/function/f_fs string table fix for multiple languages
Fixes bug with the handling of more than one language in the string table in f_fs.c. str_count was not reset for subsequent language codes. str_count-- "rolls under" and processes u32 max strings on the processing of the second language entry. The existing bug can be reproduced by adding a second language table to the structure "strings" in tools/usb/ffs-test.c. Signed-off-by: Dean Anderson <dean@sensoray.com> Link: https://lore.kernel.org/r/20210317224109.21534-1-dean@sensoray.com Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/gadget/function/f_fs.c')
-rw-r--r--drivers/usb/gadget/function/f_fs.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 801a8b668a35..10a5d9f0f2b9 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2640,6 +2640,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
do { /* lang_count > 0 so we can use do-while */
unsigned needed = needed_count;
+ u32 str_per_lang = str_count;
if (len < 3)
goto error_free;
@@ -2675,7 +2676,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
data += length + 1;
len -= length + 1;
- } while (--str_count);
+ } while (--str_per_lang);
s->id = 0; /* terminator */
s->s = NULL;