[PATCH 6/7] fotg210-udc: Don't DMA more than the buffer can take

From: Fabian Vogt <fabian@ritter-vogt.de>
To: Felipe Balbi <balbi@kernel.org>
Cc: Fabian Vogt <fabian@ritter-vogt.de>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Yuan-Hsin Chen <yhchen@faraday-tech.com>,
	linux-usb@vger.kernel.org
Subject: [PATCH 6/7] fotg210-udc: Don't DMA more than the buffer can take
Date: Wed, 24 Mar 2021 15:11:14 +0100	[thread overview]
Message-ID: <20210324141115.9384-7-fabian@ritter-vogt.de> (raw)
In-Reply-To: <20210324141115.9384-1-fabian@ritter-vogt.de>

Before this, it wrote as much as available into the buffer, even if it
didn't fit.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 6a4c60d5b2c2..7716bd1c8753 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -338,8 +338,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
 		} else {
 			buffer = req->req.buf + req->req.actual;
 			length = ioread32(ep->fotg210->reg +
-					FOTG210_FIBCR(ep->epnum - 1));
-			length &= FIBCR_BCFX;
+					FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
+			if (length > req->req.length - req->req.actual)
+				length = req->req.length - req->req.actual;
 		}
 	} else {
 		buffer = req->req.buf + req->req.actual;
-- 
2.25.1

