usb: dwc2: gadget: Expand buffer size of control endpoint 80/226880/2 accepted/tizen/unified/20200316.220920 submit/tizen/20200312.034957
authorDongwoo Lee <dwoo08.lee@samsung.com>
Fri, 6 Mar 2020 05:04:13 +0000 (14:04 +0900)
committerJunghoon Kim <jhoon20.kim@samsung.com>
Fri, 6 Mar 2020 05:54:15 +0000 (05:54 +0000)
commitb9fd2de1ec291d86ccd48b98d5dd6df1a327759e
tree37dd98ea969d2cb641c73f058ff95129077ed636
parent7f8218a9a458204841dbe4971c45f8535a273ae0
usb: dwc2: gadget: Expand buffer size of control endpoint

We found the case that buffer of control endpoint, which was allocated
with 8 bytes previously, is corrupted when the host races for setting
up interfaces. Even worse, it overwrites memory for other structure
such as usb_request for control endpoint and it causes kernel panic.
Especially in Tizen, it often happens when the target is configured as
multi-functional device: sdb + mtp.

In our emprical examination the buffer can be corrupted upto size of
456 bytes. With this result, the size of buffer will be enlarged to
512 bytes to prevent kernel panic even if it happens.

Change-Id: I20eb1283f3c82e09453960b72787175f734e7ec4
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
drivers/usb/dwc2/core.h