lkml.org 
[lkml]   [2019]   [Jul]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 31/72] usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
    Date
    commit bd6742249b9ca918565e4e3abaa06665e587f4b5 upstream

    OUT endpoint requests may somtimes have this flag set when
    preparing to be submitted to HW indicating that there is an
    additional TRB chained to the request for alignment purposes.
    If that request is removed before the controller can execute the
    transfer (e.g. ep_dequeue/ep_disable), the request will not go
    through the dwc3_gadget_ep_cleanup_completed_request() handler
    and will not have its needs_extra_trb flag cleared when
    dwc3_gadget_giveback() is called. This same request could be
    later requeued for a new transfer that does not require an
    extra TRB and if it is successfully completed, the cleanup
    and TRB reclamation will incorrectly process the additional TRB
    which belongs to the next request, and incorrectly advances the
    TRB dequeue pointer, thereby messing up calculation of the next
    requeust's actual/remaining count when it completes.

    The right thing to do here is to ensure that the flag is cleared
    before it is given back to the function driver. A good place
    to do that is in dwc3_gadget_del_and_unmap_request().

    Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
    Cc: Fei Yang <fei.yang@intel.com>
    Cc: Sam Protsenko <semen.protsenko@linaro.org>
    Cc: Felipe Balbi <balbi@kernel.org>
    Cc: linux-usb@vger.kernel.org
    Cc: stable@vger.kernel.org # 4.19.y
    Signed-off-by: Jack Pham <jackp@codeaurora.org>
    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
    (cherry picked from commit bd6742249b9ca918565e4e3abaa06665e587f4b5)
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/dwc3/gadget.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    index 843586f20572..e7122b5199d2 100644
    --- a/drivers/usb/dwc3/gadget.c
    +++ b/drivers/usb/dwc3/gadget.c
    @@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
    req->started = false;
    list_del(&req->list);
    req->remaining = 0;
    + req->needs_extra_trb = false;

    if (req->request.status == -EINPROGRESS)
    req->request.status = status;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-02 10:07    [W:7.484 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site