releases/4.14.97/usb-dwc3-gadget-clear-req-needs_extra_trb-flag-on-cleanup.patch

   1 From bd6742249b9ca918565e4e3abaa06665e587f4b5 Mon Sep 17 00:00:00 2001
   2 From: Jack Pham <jackp@codeaurora.org>
   3 Date: Thu, 10 Jan 2019 12:39:55 -0800
   4 Subject: usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup
   5
   6 From: Jack Pham <jackp@codeaurora.org>
   7
   8 commit bd6742249b9ca918565e4e3abaa06665e587f4b5 upstream.
   9
  10 OUT endpoint requests may somtimes have this flag set when
  11 preparing to be submitted to HW indicating that there is an
  12 additional TRB chained to the request for alignment purposes.
  13 If that request is removed before the controller can execute the
  14 transfer (e.g. ep_dequeue/ep_disable), the request will not go
  15 through the dwc3_gadget_ep_cleanup_completed_request() handler
  16 and will not have its needs_extra_trb flag cleared when
  17 dwc3_gadget_giveback() is called.  This same request could be
  18 later requeued for a new transfer that does not require an
  19 extra TRB and if it is successfully completed, the cleanup
  20 and TRB reclamation will incorrectly process the additional TRB
  21 which belongs to the next request, and incorrectly advances the
  22 TRB dequeue pointer, thereby messing up calculation of the next
  23 requeust's actual/remaining count when it completes.
  24
  25 The right thing to do here is to ensure that the flag is cleared
  26 before it is given back to the function driver.  A good place
  27 to do that is in dwc3_gadget_del_and_unmap_request().
  28
  29 Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize")
  30 Cc: stable@vger.kernel.org
  31 Signed-off-by: Jack Pham <jackp@codeaurora.org>
  32 Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  33 [jackp: backport to <= 4.20: replaced 'needs_extra_trb' with 'unaligned'
  34         and 'zero' members in patch and reworded commit text]
  35 Signed-off-by: Jack Pham <jackp@codeaurora.org>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37 ---
  38  drivers/usb/dwc3/gadget.c |    2 ++
  39  1 file changed, 2 insertions(+)
  40
  41 --- a/drivers/usb/dwc3/gadget.c
  42 +++ b/drivers/usb/dwc3/gadget.c
  43 @@ -182,6 +182,8 @@ void dwc3_gadget_del_and_unmap_request(s
  44         req->started = false;
  45         list_del(&req->list);
  46         req->remaining = 0;
  47 +       req->unaligned = false;
  48 +       req->zero = false;
  49
  50         if (req->request.status == -EINPROGRESS)
  51                 req->request.status = status;