fotg210-udc: Don't DMA more than the buffer can take

[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ]

Before this, it wrote as much as available into the buffer, even if it
didn't fit.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index bbcc923763070c7a3069a12591cb4741477d8419..9925d7ac9138d409ae94b5eb2daa2550e4d7b535 100644 (file)
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -338,8 +338,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
                } else {
                        buffer = req->req.buf + req->req.actual;
                        length = ioread32(ep->fotg210->reg +
-                                       FOTG210_FIBCR(ep->epnum - 1));
-                       length &= FIBCR_BCFX;
+                                       FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
+                       if (length > req->req.length - req->req.actual)
+                               length = req->req.length - req->req.actual;
                }
        } else {
                buffer = req->req.buf + req->req.actual;