Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 694dfaa2 authored by Elson Roy Serrao's avatar Elson Roy Serrao
Browse files

usb: dwc3: Add boundary check while traversing the TRB ring buffer 



During the dequeue operation of an usb request we traverse through the
TRBs and reset the HWO bit. Without a boundary check we might iterate
past the TRB ring which results in a page fault. Fix this by adding a
link TRB boundary check while traversing the ring buffer.

Change-Id: I7ae63ed7cc829a8105f2e81b12216af910aa253a
Signed-off-by: default avatarElson Roy Serrao <eserrao@codeaurora.org>
parent fbad67d3

drivers/usb/dwc3/gadget.c

+4 −3
Original line number Diff line number Diff line
@@ -1639,6 +1639,7 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, 
static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *req)

{

	int i;

	struct dwc3_trb *trb = req->trb;



	/*

	 * If request was already started, this means we had to
@@ -1651,11 +1652,11 @@ static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *r 
	 * pointer.

	 */

	for (i = 0; i < req->num_trbs; i++) {

		struct dwc3_trb *trb;



		trb = req->trb + i;

		trb->ctrl &= ~DWC3_TRB_CTRL_HWO;

		dwc3_ep_inc_deq(dep);

		trb++;

		if (trb->ctrl & DWC3_TRBCTL_LINK_TRB)

			trb = dep->trb_pool;

	}



	req->num_trbs = 0;