From: Dean Anderson dean@sensoray.com
commit 55b74ce7d2ce0b0058f3e08cab185a0afacfe39e upstream.
Fixes bug with the handling of more than one language in the string table in f_fs.c. str_count was not reset for subsequent language codes. str_count-- "rolls under" and processes u32 max strings on the processing of the second language entry. The existing bug can be reproduced by adding a second language table to the structure "strings" in tools/usb/ffs-test.c.
Signed-off-by: Dean Anderson dean@sensoray.com Link: https://lore.kernel.org/r/20210317224109.21534-1-dean@sensoray.com Cc: stable stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/usb/gadget/function/f_fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -2658,6 +2658,7 @@ static int __ffs_data_got_strings(struct
do { /* lang_count > 0 so we can use do-while */ unsigned needed = needed_count; + u32 str_per_lang = str_count;
if (unlikely(len < 3)) goto error_free; @@ -2693,7 +2694,7 @@ static int __ffs_data_got_strings(struct
data += length + 1; len -= length + 1; - } while (--str_count); + } while (--str_per_lang);
s->id = 0; /* terminator */ s->s = NULL;