Patch "usb: f_fs: off by one bug in _ffs_func_bind()" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

usb: f_fs: off by one bug in _ffs_func_bind()

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:

     usb-f_fs-off-by-one-bug-in-_ffs_func_bind.patch

and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Sat, 28 May 2016 07:48:10 +0300
Subject: usb: f_fs: off by one bug in _ffs_func_bind()

From: Dan Carpenter <[email protected]>

commit 0015f9156092d07b3ec06d37d014328419d5832e upstream.

This loop is supposed to set all the .num[] values to -1 but it's off by one so it skips the first element and sets one element past the end of the array.

I've cleaned up the loop a little as well.

---
 drivers/usb/gadget/function/f_fs.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

@@ -2740,6 +2740,7 @@ static int _ffs_func_bind(struct usb_con
 		func->ffs->ss_descs_count;
 
 	int fs_len, hs_len, ss_len, ret, i;
+	struct ffs_ep *eps_ptr;
 
 	/* Make it a single chunk, less management later on */
 	vla_group(d);

@@ -2788,12 +2789,9 @@ static int _ffs_func_bind(struct usb_con
 	       ffs->raw_descs_length);
 
 	memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
-	for (ret = ffs->eps_count; ret; --ret) {
-		struct ffs_ep *ptr;
-
-		ptr = vla_ptr(vlabuf, d, eps);
-		ptr[ret].num = -1;
-	}
+	eps_ptr = vla_ptr(vlabuf, d, eps);
+	for (i = 0; i < ffs->eps_count; i++)
+		eps_ptr[i].num = -1;
 
 	/* Save pointers
 	 * d_eps == vlabuf, func->eps used to kfree vlabuf later

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/usb-f_fs-off-by-one-bug-in-_ffs_func_bind.patch