usb: gadget: f_fs: refactor and document __ffs_ep0_read_events better

Instead of using variable length array, use a static length equal to
the size of the ffs->ev.types array.  This gets rid of a sparse warning:

	drivers/usb/gadget/function/f_fs.c:401:44: warning:
	Variable length array is used.

and makes it more explicit that the array has a very tight upper size
limit.  Also add some more documentation about the ev.types array and
how its size is limited and affects the rest of the code.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Rohith Seelaboyina <rseelaboyina@nvidia.com>
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 63314ede7ba60e8efdf9a83ead4f6f19324cbc0a..a00ee977305cfefdf0235e2a68d413249deb46a3 100644 (file)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -390,17 +390,20 @@ done_spin:
        return ret;
 }
 
+/* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
                                     size_t n)
 {
        /*
-        * We are holding ffs->ev.waitq.lock and ffs->mutex and we need
-        * to release them.
+        * n cannot be bigger than ffs->ev.count, which cannot be bigger than
+        * size of ffs->ev.types array (which is four) so that's how much space
+        * we reserve.
         */
-       struct usb_functionfs_event events[n];
+       struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
+       const size_t size = n * sizeof *events;
        unsigned i = 0;
 
-       memset(events, 0, sizeof events);
+       memset(events, 0, size);
 
        do {
                events[i].type = ffs->ev.types[i];
@@ -410,19 +413,15 @@ static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
                }
        } while (++i < n);
 
-       if (n < ffs->ev.count) {
-               ffs->ev.count -= n;
+       ffs->ev.count -= n;
+       if (ffs->ev.count)
                memmove(ffs->ev.types, ffs->ev.types + n,
                        ffs->ev.count * sizeof *ffs->ev.types);
-       } else {
-               ffs->ev.count = 0;
-       }
 
        spin_unlock_irq(&ffs->ev.waitq.lock);
        mutex_unlock(&ffs->mutex);
 
-       return unlikely(__copy_to_user(buf, events, sizeof events))
-               ? -EFAULT : sizeof events;
+       return unlikely(__copy_to_user(buf, events, size)) ? -EFAULT : size;
 }
 
 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
@@ -2377,6 +2376,13 @@ static void __ffs_event_add(struct ffs_data *ffs,
        if (ffs->setup_state == FFS_SETUP_PENDING)
                ffs->setup_state = FFS_SETUP_CANCELLED;
 
+       /*
+        * Logic of this function guarantees that there are at most four pending
+        * evens on ffs->ev.types queue.  This is important because the queue
+        * has space for four elements only and __ffs_ep0_read_events function
+        * depends on that limit as well.  If more event types are added, those
+        * limits have to be revisited or guaranteed to still hold.
+        */
        switch (type) {
        case FUNCTIONFS_RESUME:
                rem_type2 = FUNCTIONFS_SUSPEND;