[PATCH] ARM: 2653/1: Fix memset and memzero macro double-reference of parameters

Patch from Deepak Saxena

The current memset() and memzero() macros on ARM reference the
incoming parameters more than once and this can cause uninted
side-effects. The issue was found while debugging SCTP protocol
and with the specific usage of memzero(skb_put(skb,size),size).
This call would call skb_put(skb,size) twice leading to badness.
The fixed version copies the incoming parameters into local
variables and uses those instead.

Signed-off-by: Deepak Saxena
Signed-off-by: Russell King

diff --git a/include/asm-arm/string.h b/include/asm-arm/string.h
index 2a8ab162412fe70a9b78ab65cee951edd918e3fe..e50c4a39b699779f9af151397eeeb022ff2da0f5 100644 (file)
--- a/include/asm-arm/string.h
+++ b/include/asm-arm/string.h
@@ -29,15 +29,22 @@ extern void __memzero(void *ptr, __kernel_size_t n);
 
 #define memset(p,v,n)                                                  \
        ({                                                              \
-               if ((n) != 0) {                                         \
+               void *__p = (p); size_t __n = n;                        \
+               if ((__n) != 0) {                                       \
                        if (__builtin_constant_p((v)) && (v) == 0)      \
-                               __memzero((p),(n));                     \
+                               __memzero((__p),(__n));                 \
                        else                                            \
-                               memset((p),(v),(n));                    \
+                               memset((__p),(v),(__n));                \
                }                                                       \
-               (p);                                                    \
+               (__p);                                                  \
        })
 
-#define memzero(p,n) ({ if ((n) != 0) __memzero((p),(n)); (p); })
+#define memzero(p,n)                                                   \
+       ({                                                              \
+               void *__p = (p); size_t __n = n;                        \
+               if ((__n) != 0)                                         \
+                       __memzero((__p),(__n));                         \
+               (__p);                                                  \
+        })
 
 #endif