[PATCH] usb: gadget: composite: req->complete not set, using wrong callback for complete

In usb_composite_setup_continue, req->complete is not set, leaving the previous value untouched. After completion of the ep0 transaction, the UDC would then call whatever complete callback is set with the composite cdev as context, leading to all sorts of havoc.

Signed-off-by: Florian Faber <redacted>

---
 drivers/usb/gadget/composite.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 504c1cbc255d..8d497be4be32 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c

@@ -2518,6 +2518,7 @@ void usb_composite_setup_continue(struct usb_composite_dev *cdev)
 		DBG(cdev, "%s: Completing delayed status\n", __func__);
 		req->length = 0;
 		req->context = cdev;
+		req->complete = composite_setup_complete;
 		value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
 		if (value < 0) {
 			DBG(cdev, "ep_queue --> %d\n", value);

--