These changes are a raw update to a vanilla kernel 4.1.10, with the

[kvmfornfv.git] / kernel / drivers / usb / dwc3 / ep0.c

diff --git a/kernel/drivers/usb/dwc3/ep0.c b/kernel/drivers/usb/dwc3/ep0.c
index 2ef3c8d..06ecd1e 100644 (file)
--- a/kernel/drivers/usb/dwc3/ep0.c
+++ b/kernel/drivers/usb/dwc3/ep0.c
@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
                dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
                ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
                break;
+       case USB_REQ_SET_INTERFACE:
+               dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
+               dwc->start_config_issued = false;
+               /* Fall through */
        default:
                dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
                ret = dwc3_ep0_delegate_req(dwc, ctrl);
@@ -816,6 +820,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                unsigned maxp = ep0->endpoint.maxpacket;
 
                transfer_size += (maxp - (transfer_size % maxp));
+
+               /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
+               if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
+                       transfer_size = DWC3_EP0_BOUNCE_SIZE;
+
                transferred = min_t(u32, ur->length,
                                transfer_size - length);
                memcpy(ur->buf, dwc->ep0_bounce, transferred);
@@ -937,11 +946,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                        return;
                }
 
-               WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
-
                maxpacket = dep->endpoint.maxpacket;
                transfer_size = roundup(req->request.length, maxpacket);
 
+               if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
+                       dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
+                       transfer_size = DWC3_EP0_BOUNCE_SIZE;
+               }
+
                dwc->ep0_bounced = true;
 
                /*