4.10-stable patches

added patches:
	usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch

diff --git a/queue-4.10/series b/queue-4.10/series
index e844264a46c8b1d187f8431faae00aaf28a9d153..13e26241a037c5ac8cd6f5c82754553a0195dc49 100644 (file)
--- a/queue-4.10/series
+++ b/queue-4.10/series
@@ -60,3 +60,4 @@ mips-flush-wrong-invalid-ftlb-entry-for-huge-page.patch
 mips-c-r4k-fix-loongson-3-s-vcache-scache-waysize-calculation.patch
 drm-i915-gvt-fix-gvt-scheduler-interval-time.patch
 drm-i915-kvmgt-fix-suspicious-rcu-dereference-usage.patch
+usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch

diff --git a/queue-4.10/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch b/queue-4.10/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
new file mode 100644 (file)
index 0000000..203a261
--- /dev/null
+++ b/queue-4.10/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
@@ -0,0 +1,67 @@
+From de288e36fe33f7e06fa272bc8e2f85aa386d99aa Mon Sep 17 00:00:00 2001
+From: Janusz Dziedzic <januszx.dziedzic@intel.com>
+Date: Mon, 13 Mar 2017 14:11:32 +0200
+Subject: usb: dwc3: gadget: delay unmap of bounced requests
+
+From: Janusz Dziedzic <januszx.dziedzic@intel.com>
+
+commit de288e36fe33f7e06fa272bc8e2f85aa386d99aa upstream.
+
+In the case of bounced ep0 requests, we must delay DMA operation until
+after ->complete() otherwise we might overwrite contents of req->buf.
+
+This caused problems with RNDIS gadget.
+
+Signed-off-by: Janusz Dziedzic <januszx.dziedzic@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c |   21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -171,6 +171,7 @@ void dwc3_gadget_giveback(struct dwc3_ep
+               int status)
+ {
+       struct dwc3                     *dwc = dep->dwc;
++      unsigned int                    unmap_after_complete = false;
+ 
+       req->started = false;
+       list_del(&req->list);
+@@ -180,11 +181,19 @@ void dwc3_gadget_giveback(struct dwc3_ep
+       if (req->request.status == -EINPROGRESS)
+               req->request.status = status;
+ 
+-      if (dwc->ep0_bounced && dep->number <= 1)
++      /*
++       * NOTICE we don't want to unmap before calling ->complete() if we're
++       * dealing with a bounced ep0 request. If we unmap it here, we would end
++       * up overwritting the contents of req->buf and this could confuse the
++       * gadget driver.
++       */
++      if (dwc->ep0_bounced && dep->number <= 1) {
+               dwc->ep0_bounced = false;
+-
+-      usb_gadget_unmap_request_by_dev(dwc->sysdev,
+-                      &req->request, req->direction);
++              unmap_after_complete = true;
++      } else {
++              usb_gadget_unmap_request_by_dev(dwc->sysdev,
++                              &req->request, req->direction);
++      }
+ 
+       trace_dwc3_gadget_giveback(req);
+ 
+@@ -192,6 +201,10 @@ void dwc3_gadget_giveback(struct dwc3_ep
+       usb_gadget_giveback_request(&dep->endpoint, &req->request);
+       spin_lock(&dwc->lock);
+ 
++      if (unmap_after_complete)
++              usb_gadget_unmap_request_by_dev(dwc->sysdev,
++                              &req->request, req->direction);
++
+       if (dep->number > 1)
+               pm_runtime_put(dwc->dev);
+ }