usb: dwc2: Fix crash in incomplete isoc intr handlers.

Crash caused by going out of "eps_out" array range.
Iteration on "eps_out" changed to less than "num_of_eps".

Signed-off-by: Artur Petrosyan <arturp@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index abd22b4f8c9954e8f455b08c63127bbf7e90e7a2..37ee467abea989ac414bf94a33aa2f93cdd9355f 100644 (file)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3409,7 +3409,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg)
 
        daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);
 
-       for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
+       for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                hs_ep = hsotg->eps_in[idx];
                /* Proceed only unmasked ISOC EPs */
                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
@@ -3455,7 +3455,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg)
        daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);
        daintmsk >>= DAINT_OUTEP_SHIFT;
 
-       for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
+       for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                hs_ep = hsotg->eps_out[idx];
                /* Proceed only unmasked ISOC EPs */
                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
@@ -3629,7 +3629,7 @@ irq_retry:
                dwc2_writel(gintmsk, hsotg->regs + GINTMSK);
 
                dev_dbg(hsotg->dev, "GOUTNakEff triggered\n");
-               for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
+               for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                        hs_ep = hsotg->eps_out[idx];
                        /* Proceed only unmasked ISOC EPs */
                        if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))