From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Oct 2017 08:29:16 +0000 (+0200)
Subject: 4.13-stable patches
X-Git-Tag: v3.18.74~8
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=179295765290da1dba89f21daed2350a9c6bbf4c;p=thirdparty%2Fkernel%2Fstable-queue.git

4.13-stable patches

added patches:
	usb-dwc3-ep0-fix-dma-starvation-by-assigning-req-trb-on-ep0.patch
---

diff --git a/queue-4.13/series b/queue-4.13/series
index ae960eab663..b518d50e1e8 100644
--- a/queue-4.13/series
+++ b/queue-4.13/series
@@ -1 +1,2 @@
 imx-media-of-avoid-uninitialized-variable-warning.patch
+usb-dwc3-ep0-fix-dma-starvation-by-assigning-req-trb-on-ep0.patch
diff --git a/queue-4.13/usb-dwc3-ep0-fix-dma-starvation-by-assigning-req-trb-on-ep0.patch b/queue-4.13/usb-dwc3-ep0-fix-dma-starvation-by-assigning-req-trb-on-ep0.patch
new file mode 100644
index 00000000000..95add31d2e3
--- /dev/null
+++ b/queue-4.13/usb-dwc3-ep0-fix-dma-starvation-by-assigning-req-trb-on-ep0.patch
@@ -0,0 +1,52 @@
+From 55168470835688e5da5828cdcf1b1498d7baadb1 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Mon, 11 Sep 2017 10:45:12 +0300
+Subject: usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 55168470835688e5da5828cdcf1b1498d7baadb1 upstream.
+
+If we don't assign a TRB to ep0 requests, we won't be able to unmap
+the request later on resulting in starvation of DMA resources.
+
+Fixes: 4a71fcb8ac5f ("usb: dwc3: gadget: only unmap requests from DMA if mapped")
+Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Tested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(s
+ 					 DWC3_TRBCTL_CONTROL_DATA,
+ 					 true);
+ 
++		req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
++
+ 		/* Now prepare one extra TRB to align transfer size */
+ 		dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
+ 					 maxpacket - rem,
+@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(s
+ 					 DWC3_TRBCTL_CONTROL_DATA,
+ 					 true);
+ 
++		req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
++
+ 		/* Now prepare one extra TRB to align transfer size */
+ 		dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
+ 					 0, DWC3_TRBCTL_CONTROL_DATA,
+@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(s
+ 		dwc3_ep0_prepare_one_trb(dep, req->request.dma,
+ 				req->request.length, DWC3_TRBCTL_CONTROL_DATA,
+ 				false);
++
++		req->trb = &dwc->ep0_trb[dep->trb_enqueue];
++
+ 		ret = dwc3_ep0_start_trans(dep);
+ 	}
+