[PATCH] usb: gadget: composite: req->complete not set, using wrong callback for complete

In usb_composite_setup_continue, req->complete is not set, leaving the 
previous value untouched. After completion of the ep0 transaction, the 
UDC would then call whatever complete callback is set with the composite 
cdev as context, leading to all sorts of havoc.

Signed-off-by: Florian Faber <redacted>

---
  drivers/usb/gadget/composite.c | 1 +
  1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 504c1cbc255d..8d497be4be32 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c

@@ -2518,6 +2518,7 @@ void usb_composite_setup_continue(struct 

usb_composite_dev *cdev)
  		DBG(cdev, "%s: Completing delayed status\n", __func__);
  		req->length = 0;
  		req->context = cdev;
+		req->complete = composite_setup_complete;
  		value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
  		if (value < 0) {
  			DBG(cdev, "ep_queue --> %d\n", value);
--