From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>

If the last PRD entry flag is not set, the condition (i + 1) < 
USB3_DMA_NUM_PRD_ENTRIES is always true on the first iteration when i
equals zero, causing the loop to break immediately and only one PRD
entry to be processed.

Fix the comparison operator from < to >= so the loop breaks when the
PRD table is exhausted.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 2d4aa21a73ba ("usb: gadget: udc: renesas_usb3: add support for dedicated DMAC")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
---
 drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index c6f2a09f561d..22404ef40601 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1410,7 +1410,7 @@ static int usb3_dma_update_status(struct renesas_usb3_ep *usb3_ep,
 		req->actual += len - remain;
 
 		if (cur_prd->word1 & USB3_PRD1_E ||
-		    (i + 1) < USB3_DMA_NUM_PRD_ENTRIES)
+		    (i + 1) >= USB3_DMA_NUM_PRD_ENTRIES)
 			break;
 
 		cur_prd++;
-- 
2.43.0