[lvc-project] [PATCH] usb: gadget: udc: renesas_usb3: Fix wrong comparison in usb3_dma_fill_prd()

[Alexander.Chesnokov at kaspersky.com]

From: Alexander Chesnokov <Alexander.Chesnokov at kaspersky.com>

If remain is not zero, the condition (i + 1) < USB3_DMA_NUM_PRD_ENTRIES
is always true on the first iteration when i equals zero, causing the
loop to break immediately and only one PRD entry to be filled.

Fix the comparison operator from < to >= so the loop breaks when the
PRD table is full.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 2d4aa21a73ba ("usb: gadget: udc: renesas_usb3: add support for dedicated DMAC")
Cc: stable at vger.kernel.org

Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov at kaspersky.com>
---
 drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index f24d63c396df..c6f2a09f561d 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1347,7 +1347,7 @@ static void usb3_dma_fill_prd(struct renesas_usb3_ep *usb3_ep,
 		cur_prd->bap = dma;
 		remain -= len;
 		dma += len;
-		if (!remain || (i + 1) < USB3_DMA_NUM_PRD_ENTRIES)
+		if (!remain || (i + 1) >= USB3_DMA_NUM_PRD_ENTRIES)
 			break;
 
 		cur_prd++;
-- 
2.43.0