[PATCH] ARM: 2653/1: Fix memset and memzero macro double-reference of parameters

Patch from Deepak Saxena

The current memset() and memzero() macros on ARM reference the
incoming parameters more than once and this can cause uninted
side-effects. The issue was found while debugging SCTP protocol
and with the specific usage of memzero(skb_put(skb,size),size).
This call would call skb_put(skb,size) twice leading to badness.
The fixed version copies the incoming parameters into local
variables and uses those instead.

Signed-off-by: Deepak Saxena
Signed-off-by: Russell King

1 files changed, 12 insertions, 5 deletions

diff --git a/include/asm-arm/string.h b/include/asm-arm/string.h
index 2a8ab162412f..e50c4a39b699 100644
--- a/include/asm-arm/string.h
+++ b/include/asm-arm/string.h
@@ -29,15 +29,22 @@ extern void __memzero(void *ptr, __kernel_size_t n);
 
 #define memset(p,v,n)                                                   \
         ({                                                              \
-                if ((n) != 0) {                                         \
+                void *__p = (p); size_t __n = n;                        \
+                if ((__n) != 0) {                                       \
                         if (__builtin_constant_p((v)) && (v) == 0)      \
-                                __memzero((p),(n));                     \
+                                __memzero((__p),(__n));                 \
                         else                                            \
-                                memset((p),(v),(n));                    \
+                                memset((__p),(v),(__n));                \
                 }                                                       \
-                (p);                                                    \
+                (__p);                                                  \
         })
 
-#define memzero(p,n) ({ if ((n) != 0) __memzero((p),(n)); (p); })
+#define memzero(p,n)                                                    \
+        ({                                                              \
+                void *__p = (p); size_t __n = n;                        \
+                if ((__n) != 0)                                         \
+                        __memzero((__p),(__n));                         \
+                (__p);                                                  \
+         })
 
 #endif