[PATCH v1 3/3] usb: gadget: configfs: drop dead store in webusb_landingPage_store()

[Aristo Chen]

bytes_to_strip is used for two unrelated purposes in
webusb_landingPage_store(). It is first incremented to account for a
trailing newline:

	if (page[l - 1] == '\n') {
		--l;
		++bytes_to_strip;
	}

and then unconditionally overwritten a few lines later by the URL scheme
detection, so the increment is a dead store: the newline has already
been accounted for by --l.

The dead store makes the subsequent bound check

	if (l > U8_MAX - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + bytes_to_strip)

read as though it also allows for the newline when it does not, so
anyone auditing that bound has to first work out that one of the two
meanings of bytes_to_strip is dead. Compilers do not warn about this
because the variable is genuinely used later.

Drop the increment and rename the variable to scheme_len, which is what
it actually holds. No functional change.

Signed-off-by: Aristo Chen <aristo.chen@xxxxxxxxxxxxx>
---
 drivers/usb/gadget/configfs.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 4bc95f4b6670..02e619ed14f5 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1062,15 +1062,13 @@ static ssize_t webusb_landingPage_store(struct config_item *item, const char *pa
 				     size_t len)
 {
 	struct gadget_info *gi = webusb_item_to_gadget_info(item);
-	unsigned int bytes_to_strip = 0;
+	unsigned int scheme_len;
 	int l = len;
 
 	if (!len)
 		return len;
-	if (page[l - 1] == '\n') {
+	if (page[l - 1] == '\n')
 		--l;
-		++bytes_to_strip;
-	}
 
 	if (l > WEBUSB_URL_RAW_MAX_LENGTH) {
 		pr_err("webusb: landingPage URL too long\n");
@@ -1079,15 +1077,15 @@ static ssize_t webusb_landingPage_store(struct config_item *item, const char *pa
 
 	// validation
 	if (strncasecmp(page, "https://";,  8) == 0)
-		bytes_to_strip = 8;
+		scheme_len = 8;
 	else if (strncasecmp(page, "http://";, 7) == 0)
-		bytes_to_strip = 7;
+		scheme_len = 7;
 	else
-		bytes_to_strip = 0;
+		scheme_len = 0;
 
-	if (l > U8_MAX - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + bytes_to_strip) {
+	if (l > U8_MAX - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + scheme_len) {
 		pr_err("webusb: landingPage URL %d bytes too long for given URL scheme\n",
-			l - U8_MAX + WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH - bytes_to_strip);
+			l - U8_MAX + WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH - scheme_len);
 		return -EINVAL;
 	}
 
-- 
2.53.0