Patch "usb: fotg210-hcd: delete an incorrect bounds test" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    usb: fotg210-hcd: delete an incorrect bounds test

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-fotg210-hcd-delete-an-incorrect-bounds-test.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 819aa1d773adbe0d7c2949c5f77b9eb84f10e20a
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date:   Wed Dec 13 16:22:43 2023 +0300

    usb: fotg210-hcd: delete an incorrect bounds test
    
    [ Upstream commit 7fbcd195e2b8cc952e4aeaeb50867b798040314c ]
    
    Here "temp" is the number of characters that we have written and "size"
    is the size of the buffer.  The intent was clearly to say that if we have
    written to the end of the buffer then stop.
    
    However, for that to work the comparison should have been done on the
    original "size" value instead of the "size -= temp" value.  Not only
    will that not trigger when we want to, but there is a small chance that
    it will trigger incorrectly before we want it to and we break from the
    loop slightly earlier than intended.
    
    This code was recently changed from using snprintf() to scnprintf().  With
    snprintf() we likely would have continued looping and passed a negative
    size parameter to snprintf().  This would have triggered an annoying
    WARN().  Now that we have converted to scnprintf() "size" will never
    drop below 1 and there is no real need for this test.  We could change
    the condition to "if (temp <= 1) goto done;" but just deleting the test
    is cleanest.
    
    Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver")
    Cc: stable <stable@xxxxxxxxxx>
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Reviewed-by: Linus Walleij <linus.walleij@xxxxxxxxxx>
    Reviewed-by: Lee Jones <lee@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/ZXmwIwHe35wGfgzu@suswa
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 1577424319613..d87b4fb0d9af6 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -426,8 +426,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh,
 			temp = size;
 		size -= temp;
 		next += temp;
-		if (temp == size)
-			goto done;
 	}
 
 	temp = snprintf(next, size, "\n");
@@ -437,7 +435,6 @@ static void qh_lines(struct fotg210_hcd *fotg210, struct fotg210_qh *qh,
 	size -= temp;
 	next += temp;
 
-done:
 	*sizep = size;
 	*nextp = next;
 }