usb: dwc2: limit "maximum packet size" for split-IN transfers

dwc2_hc_start_transfer() overwrites hc->xfer_len for split-IN transfers.
Drivers may not allocate buffers that are multiples of the endpoint max
packet size, which may cause buffer overruns in the last transfer.

The hardware needs HCTSIZ to be set to a multiple of HCCHAR.MPS, so trim
chan->max_packet in dwc2_assign_and_init_hc().

Signed-off-by: Jonathan Bell <[email protected]>

Author: P33M

drivers/usb/dwc2/hcd.c

@@ -2646,6 +2646,10 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
 	else
 		chan->do_split = 0;
 
+	/* Limit split IN transfers to the remaining buffer space */
+	if (qh->do_split && chan->ep_is_in)
+		chan->max_packet = min_t(u32, chan->max_packet, chan->xfer_len);
+
 	/* Set the transfer attributes */
 	dwc2_hc_init_xfer(hsotg, chan, qtd);