[PATCH] usb: musb: gadget: stall when SETUP packet size is invalid

[Bin Liu]

Signed-off-by: Bin Liu <b-...@ti.com>
---
 drivers/usb/musb/musb_gadget_ep0.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_gadget_ep0.c 
b/drivers/usb/musb/musb_gadget_ep0.c
index 3e9ec7c..f31b9b1 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -664,6 +664,24 @@ __acquires(musb->lock)
        return retval;
 }
 
+/* dump the EP0 fifo for debug */
+static void musb_g_ep0_dump_fifo(struct musb *musb, int len)
+{
+       u8 *t;
+
+       if (len <= 0)
+               return;
+
+       t = kzalloc(len, GFP_KERNEL);
+       if (!t)
+               return;
+
+       musb->ops->read_fifo(&musb->endpoints[0], len, t);
+       print_hex_dump(KERN_ERR, "packet: ", DUMP_PREFIX_NONE,
+                       16, 1, t, len, false);
+       kfree(t);
+}
+
 /*
  * Handle peripheral ep0 interrupt
  *
@@ -813,7 +831,10 @@ setup:
 
                        if (len != 8) {
                                ERR("SETUP packet len %d != 8 ?\n", len);
-                               break;
+                               musb_g_ep0_dump_fifo(musb, len);
+                               musb->ackpend = MUSB_CSR0_P_SVDRXPKTRDY;
+                               retval = IRQ_HANDLED;
+                               goto stall;
                        }
                        musb_read_setup(musb, &setup);
                        retval = IRQ_HANDLED;
-- 
1.8.4

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html