Thinh Nguyen wrote:
> The SG list may be set up with entry size more than the requested
> length. Check the usb_request->length and make sure that we don't setup
> the TRBs to send/receive more than requested. This case may occur when
> the SG entry is allocated up to a certain minimum size, but the request
> length is less than that. It can also occur when the request is reused
> for a different request length.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: a31e63b608ff ("usb: dwc3: gadget: Correct handling of scattergather lists")
> Signed-off-by: Thinh Nguyen <thinhn@xxxxxxxxxxxx>
> ---
> drivers/usb/dwc3/gadget.c | 41 ++++++++++++++++++++++++++-------------
> 1 file changed, 27 insertions(+), 14 deletions(-)
>
>
Got a little trigger happy with this patch. Too many obvious issues.
Please ignore this patch for now. Will revise and resubmit.
Thanks,
Thinh
