From: Greg Kroah-Hartman Date: Tue, 3 Dec 2024 10:54:50 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.19.325~36 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ef76b11e359d142e6a896d26e7607dab31628dde;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch --- diff --git a/queue-4.19/series b/queue-4.19/series index 6dcf0911c7d..4a9a87aaf07 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -121,3 +121,4 @@ arm64-tls-fix-context-switching-of-tpidrro_el0-when-kpti-is-enabled.patch block-fix-ordering-between-checking-blk_mq_s_stopped-request-adding.patch hid-wacom-interpret-tilt-data-from-intuos-pro-bt-as-signed-values.patch media-wl128x-fix-atomicity-violation-in-fmc_send_cmd.patch +usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch diff --git a/queue-4.19/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch b/queue-4.19/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch new file mode 100644 index 00000000000..ba651c22a21 --- /dev/null +++ b/queue-4.19/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch @@ -0,0 +1,53 @@ +From 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 14 Nov 2024 01:02:12 +0000 +Subject: usb: dwc3: gadget: Fix checking for number of TRBs left + +From: Thinh Nguyen + +commit 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 upstream. + +The check whether the TRB ring is full or empty in dwc3_calc_trbs_left() +is insufficient. It assumes there are active TRBs if there's any request +in the started_list. However, that's not the case for requests with a +large SG list. + +That is, if we have a single usb request that requires more TRBs than +the total TRBs in the TRB ring, the queued TRBs will be available when +all the TRBs in the ring are completed. But the request is only +partially completed and remains in the started_list. With the current +logic, the TRB ring is empty, but dwc3_calc_trbs_left() returns 0. + +Fix this by additionally checking for the request->num_trbs for active +TRB count. + +Cc: stable@vger.kernel.org +Fixes: 51f1954ad853 ("usb: dwc3: gadget: Fix dwc3_calc_trbs_left()") +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/708dc62b56b77da1f704cc2ae9b6ddb1f2dbef1f.1731545781.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -903,11 +903,14 @@ static u32 dwc3_calc_trbs_left(struct dw + * pending to be processed by the driver. + */ + if (dep->trb_enqueue == dep->trb_dequeue) { ++ struct dwc3_request *req; ++ + /* +- * If there is any request remained in the started_list at +- * this point, that means there is no TRB available. ++ * If there is any request remained in the started_list with ++ * active TRBs at this point, then there is no TRB available. + */ +- if (!list_empty(&dep->started_list)) ++ req = next_request(&dep->started_list); ++ if (req && req->num_trbs) + return 0; + + return DWC3_TRB_NUM - 1;