1 files changed, 17 insertions, 10 deletions

diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index c6f96a2b3110..4b9797d07a67 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -460,7 +460,6 @@ struct fsg_dev {
 
         struct fsg_buffhd       *next_buffhd_to_fill;
         struct fsg_buffhd       *next_buffhd_to_drain;
-        struct fsg_buffhd       buffhds[FSG_NUM_BUFFERS];
 
         int                     thread_wakeup_needed;
         struct completion       thread_notifier;
@@ -487,6 +486,8 @@ struct fsg_dev {
         unsigned int            nluns;
         struct fsg_lun          *luns;
         struct fsg_lun          *curlun;
+        /* Must be the last entry */
+        struct fsg_buffhd       buffhds[];
 };
 
 typedef void (*fsg_routine_t)(struct fsg_dev *);
@@ -2737,7 +2738,7 @@ static int do_set_interface(struct fsg_dev *fsg, int altsetting)
 
 reset:
         /* Deallocate the requests */
-        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+        for (i = 0; i < fsg_num_buffers; ++i) {
                 struct fsg_buffhd *bh = &fsg->buffhds[i];
 
                 if (bh->inreq) {
@@ -2798,7 +2799,7 @@ reset:
         }
 
         /* Allocate the requests */
-        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+        for (i = 0; i < fsg_num_buffers; ++i) {
                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
 
                 if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
@@ -2894,7 +2895,7 @@ static void handle_exception(struct fsg_dev *fsg)
         /* Cancel all the pending transfers */
         if (fsg->intreq_busy)
                 usb_ep_dequeue(fsg->intr_in, fsg->intreq);
-        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+        for (i = 0; i < fsg_num_buffers; ++i) {
                 bh = &fsg->buffhds[i];
                 if (bh->inreq_busy)
                         usb_ep_dequeue(fsg->bulk_in, bh->inreq);
@@ -2905,7 +2906,7 @@ static void handle_exception(struct fsg_dev *fsg)
         /* Wait until everything is idle */
         for (;;) {
                 num_active = fsg->intreq_busy;
-                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                for (i = 0; i < fsg_num_buffers; ++i) {
                         bh = &fsg->buffhds[i];
                         num_active += bh->inreq_busy + bh->outreq_busy;
                 }
@@ -2927,7 +2928,7 @@ static void handle_exception(struct fsg_dev *fsg)
          * state, and the exception.  Then invoke the handler. */
         spin_lock_irq(&fsg->lock);
 
-        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+        for (i = 0; i < fsg_num_buffers; ++i) {
                 bh = &fsg->buffhds[i];
                 bh->state = BUF_STATE_EMPTY;
         }
@@ -3157,7 +3158,7 @@ static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
         }
 
         /* Free the data buffers */
-        for (i = 0; i < FSG_NUM_BUFFERS; ++i)
+        for (i = 0; i < fsg_num_buffers; ++i)
                 kfree(fsg->buffhds[i].buf);
 
         /* Free the request and buffer for endpoint 0 */
@@ -3445,7 +3446,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
         req->complete = ep0_complete;
 
         /* Allocate the data buffers */
-        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+        for (i = 0; i < fsg_num_buffers; ++i) {
                 struct fsg_buffhd       *bh = &fsg->buffhds[i];
 
                 /* Allocate for the bulk-in endpoint.  We assume that
@@ -3456,7 +3457,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                         goto out;
                 bh->next = bh + 1;
         }
-        fsg->buffhds[FSG_NUM_BUFFERS - 1].next = &fsg->buffhds[0];
+        fsg->buffhds[fsg_num_buffers - 1].next = &fsg->buffhds[0];
 
         /* This should reflect the actual gadget power source */
         usb_gadget_set_selfpowered(gadget);
@@ -3572,7 +3573,9 @@ static int __init fsg_alloc(void)
 {
         struct fsg_dev          *fsg;
 
-        fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
+        fsg = kzalloc(sizeof *fsg +
+                      fsg_num_buffers * sizeof *(fsg->buffhds), GFP_KERNEL);
+
         if (!fsg)
                 return -ENOMEM;
         spin_lock_init(&fsg->lock);
@@ -3590,6 +3593,10 @@ static int __init fsg_init(void)
         int             rc;
         struct fsg_dev  *fsg;
 
+        rc = fsg_num_buffers_validate();
+        if (rc != 0)
+                return rc;
+
         if ((rc = fsg_alloc()) != 0)
                 return rc;
         fsg = the_fsg;