usb: dwc2: gadget: Expand buffer size of control endpoint 46/308446/2
authorDongwoo Lee <dwoo08.lee@samsung.com>
Fri, 6 Mar 2020 05:04:13 +0000 (14:04 +0900)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Tue, 26 Mar 2024 00:21:58 +0000 (00:21 +0000)
commit4b74cd8fdf66d4cb128d9249d9b2ada34dc98921
tree93d62349ce4a6751d92a5987b1f5e259ba410be3
parenta05a10522b0be8aa0e178a69d15539e93221c021
usb: dwc2: gadget: Expand buffer size of control endpoint

We found the case that buffer of control endpoint, which was allocated
with 8 bytes previously, is corrupted when the host races for setting
up interfaces. Even worse, it overwrites memory for other structure
such as usb_request for control endpoint and it causes kernel panic.
Especially in Tizen, it often happens when the target is configured as
multi-functional device: sdb + mtp.

In our emprical examination the buffer can be corrupted upto size of
456 bytes. With this result, the size of buffer will be enlarged to
512 bytes to prevent kernel panic even if it happens.

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
(cherry picked from commit 4039de56979d2fb4d1cd7acf99e3b0215337a08d)
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Change-Id: I8e9b04a9f290523147cc93686cc9de95ceeb4c00
drivers/usb/dwc2/core.h