Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 05dac708 authored by Thinh Nguyen's avatar Thinh Nguyen Committed by Greg Kroah-Hartman
Browse files

usb: dwc3: gadget: Check MPS of the request length 



commit ca3df3468eec87f6374662f7de425bc44c3810c1 upstream.

When preparing for SG, not all the entries are prepared at once. When
resume, don't use the remaining request length to calculate for MPS
alignment. Use the entire request->length to do that.

Cc: stable@vger.kernel.org
Fixes: 5d187c0454ef ("usb: dwc3: gadget: Don't setup more than requested")
Signed-off-by: default avatarThinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7ba24610

drivers/usb/dwc3/gadget.c

+2 −2
Original line number Diff line number Diff line
@@ -1057,6 +1057,8 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, 
	struct scatterlist *s;

	int		i;

	unsigned int length = req->request.length;

	unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);

	unsigned int rem = length % maxp;

	unsigned int remaining = req->request.num_mapped_sgs

		- req->num_queued_sgs;
@@ -1068,8 +1070,6 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, 
		length -= sg_dma_len(s);



	for_each_sg(sg, s, remaining, i) {

		unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);

		unsigned int rem = length % maxp;

		unsigned int trb_length;

		unsigned chain = true;