Re: [PATCH] usb: gadget: composite: req->complete not set, using wrong callback for complete

In usb_composite_setup_continue, req->complete is not set, leaving the
previous value untouched. After completion of the ep0 transaction, the UDC
would then call whatever complete callback is set with the composite cdev as
context, leading to all sorts of havoc.

Signed-off-by: Florian Faber <redacted>

---
 drivers/usb/gadget/composite.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 504c1cbc255d..8d497be4be32 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c

@@ -2518,6 +2518,7 @@ void usb_composite_setup_continue(struct

usb_composite_dev *cdev)
 		DBG(cdev, "%s: Completing delayed status\n", __func__);
 		req->length = 0;
 		req->context = cdev;
+		req->complete = composite_setup_complete;
 		value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
 		if (value < 0) {
 			DBG(cdev, "ep_queue --> %d\n", value);
--