]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM
authorYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Mon, 8 Mar 2021 01:55:38 +0000 (10:55 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Mar 2021 15:34:32 +0000 (16:34 +0100)
commit892d0f41ff40d0dcf00766468afe691a29320a47
tree5ff79409d1960c7a481bdbaba0e8114b1c6384d8
parent82cb52786bb6e18b20e3e5aa4bb0e547cb852f2a
usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM

commit b1d25e6ee57c2605845595b6c61340d734253eb3 upstream.

According to the datasheet, this controller has a restriction
which "set an endpoint number so that combinations of the DIR bit and
the EPNUM bits do not overlap.". However, since the udc core driver is
possible to assign a bulk pipe as an interrupt endpoint, an endpoint
number may not match the pipe number. After that, when user rebinds
another gadget driver, this driver broke the restriction because
the driver didn't clear any configuration in usb_ep_disable().

Example:
 # modprobe g_ncm
 Then, EP3 = pipe 3, EP4 = pipe 4, EP5 = pipe 6
 # rmmod g_ncm
 # modprobe g_hid
 Then, EP3 = pipe 6, EP4 = pipe 7.
 So, pipe 3 and pipe 6 are set as EP3.

So, clear PIPECFG register in usbhs_pipe_free().

Fixes: dfb87b8bfe09 ("usb: renesas_usbhs: gadget: fix re-enabling pipe without re-connecting")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1615168538-26101-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/renesas_usbhs/pipe.c