Merge "usb: dwc3: Add boundary check while traversing the TRB ring buffer" (2e3a6edc) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/usb/dwc3/gadget.c

+7 −4

Original line number	Diff line number	Diff line
		@@ -1695,17 +1695,18 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
		goto out0;

		if (r->num_pending_sgs) {
		struct dwc3_trb *trb;
		struct dwc3_trb *trb = r->trb;
		int i = 0;

		for (i = 0; i < r->num_pending_sgs; i++) {
		trb = r->trb + i;
		trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
		dwc3_ep_inc_deq(dep);
		trb++;
		if (trb->ctrl & DWC3_TRBCTL_LINK_TRB)
		trb = dep->trb_pool;
		}

		if (r->unaligned \|\| r->zero) {
		trb = r->trb + r->num_pending_sgs + 1;
		trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
		dwc3_ep_inc_deq(dep);
		}
		@@ -1716,7 +1717,9 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
		dwc3_ep_inc_deq(dep);

		if (r->unaligned \|\| r->zero) {
		trb = r->trb + 1;
		trb++;
		if (trb->ctrl & DWC3_TRBCTL_LINK_TRB)
		trb = dep->trb_pool;
		trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
		dwc3_ep_inc_deq(dep);
		}