diff mbox series

usb: dwc3: gadget: Don't setup more than requested

Message ID 7685ba14eaa185a170d6c4c9668d2ad98eeb8b14.1588380090.git.thinhn@synopsys.com
State New
Headers show
Series usb: dwc3: gadget: Don't setup more than requested | expand

Commit Message

Thinh Nguyen May 2, 2020, 12:44 a.m. UTC
The sgl may be allocated larger than the requested length. Check the
usb_request->length and make sure that we don't setup the TRB to
send/receive more than requested.

Cc: stable@vger.kernel.org
Fixes: a31e63b608ff ("usb: dwc3: gadget: Correct handling of scattergather lists")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
---
 drivers/usb/dwc3/gadget.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 4ca3e197bee4..95ec39e42409 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1040,7 +1040,8 @@  static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
 	unsigned		no_interrupt = req->request.no_interrupt;
 
 	if (req->request.num_sgs > 0) {
-		length = sg_dma_len(req->start_sg);
+		length = min_t(unsigned int, req->request.length,
+			       sg_dma_len(req->start_sg));
 		dma = sg_dma_address(req->start_sg);
 	} else {
 		length = req->request.length;