raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity

usb: dwc2: limit "maximum packet size" for split-IN transfers

Browse Source 
dwc2_hc_start_transfer() overwrites hc->xfer_len for split-IN transfers.
Drivers may not allocate buffers that are multiples of the endpoint max
packet size, which may cause buffer overruns in the last transfer.

The hardware needs HCTSIZ to be set to a multiple of HCCHAR.MPS, so trim
chan->max_packet in dwc2_assign_and_init_hc().

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
This commit is contained in:
Jonathan Bell
2025-06-11 15:52:40 +01:00
committed by Dom Cobley
parent bd331e3ea4
commit dc30fdb974
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/usb/dwc2/hcd.c
View File

@@ -2338,6 +2338,7 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg,
else
chan->xfer_buf = urb->setup_packet;
chan->xfer_len = 8;
chan->max_packet = 8;
break;
case DWC2_CONTROL_DATA:
@@ -2621,6 +2622,10 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
else
chan->do_split = 0;
/* Limit split IN transfers to the remaining buffer space */
if (qh->do_split && chan->ep_is_in)
chan->max_packet = min_t(u32, chan->max_packet, chan->xfer_len);
/* Set the transfer attributes */
dwc2_hc_init_xfer(hsotg, chan, qtd);