usb: dwc3: gadget: Don't setup more than requested
authorThinh Nguyen <Thinh.Nguyen@synopsys.com>
Fri, 7 Aug 2020 02:46:23 +0000 (19:46 -0700)
committerFelipe Balbi <balbi@kernel.org>
Mon, 17 Aug 2020 12:19:02 +0000 (15:19 +0300)
commit5d187c0454ef4c5e046a81af36882d4d515922ec
treef0d1347b1baf9fb91dcb9f0bda032a62d3b2c2da
parent07c8434150f4eb0b65cae288721c8af1080fde17
usb: dwc3: gadget: Don't setup more than requested

The SG list may be set up with entry size more than the requested
length. Check the usb_request->length and make sure that we don't setup
the TRBs to send/receive more than requested. This case may occur when
the SG entry is allocated up to a certain minimum size, but the request
length is less than that. It can also occur when the request is reused
for a different request length.

Cc: <stable@vger.kernel.org> # v4.18+
Fixes: a31e63b608ff ("usb: dwc3: gadget: Correct handling of scattergather lists")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
drivers/usb/dwc3/gadget.c