raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity

usb: dwc2: limit "maximum packet size" for split-IN transfers

Browse Source 
dwc2_hc_start_transfer() overwrites hc->xfer_len for split-IN transfers.
Drivers may not allocate buffers that are multiples of the endpoint max
packet size, which may cause buffer overruns in the last transfer.

The hardware needs HCTSIZ to be set to a multiple of HCCHAR.MPS, so trim
chan->max_packet in dwc2_assign_and_init_hc().

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
This commit is contained in:
Jonathan Bell
2025-06-11 15:52:40 +01:00
committed by Phil Elwell
parent 6d04c6daa4
commit 7f0e46a5e4
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/usb/dwc2/hcd.c
View File

@@ -2646,6 +2646,10 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
else
chan->do_split = 0;
/* Limit split IN transfers to the remaining buffer space */
if (qh->do_split && chan->ep_is_in)
chan->max_packet = min_t(u32, chan->max_packet, chan->xfer_len);
/* Set the transfer attributes */
dwc2_hc_init_xfer(hsotg, chan, qtd);