usb: dwc3: gadget: Don't delay End Transfer on delayed_status

commit 4db0fbb601361767144e712beb96704b966339f5 upstream.

The gadget driver may wait on the request completion when it sets the
USB_GADGET_DELAYED_STATUS. Make sure that the End Transfer command can
go through if the dwc->delayed_status is set so that the request can
complete. When the delayed_status is set, the Setup packet is already
processed, and the next phase should be either Data or Status. It's
unlikely that the host would cancel the control transfer and send a new
Setup packet during End Transfer command. But if that's the case, we can
try again when ep0state returns to EP0_SETUP_PHASE.

Fixes: e1ee843488d5 ("usb: dwc3: gadget: Force sending delayed status during soft disconnect")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/3f9f59e5d74efcbaee444cf4b30ef639cc7b124e.1666146954.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8bd063f4eff229fb76c32c41cafe09af57c7cc13..ccacbe6a2c57729f2f1a987d1074e40b62b72ac8 100644 (file)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1680,6 +1680,16 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int
        cmd |= DWC3_DEPCMD_PARAM(dep->resource_index);
        memset(&params, 0, sizeof(params));
        ret = dwc3_send_gadget_ep_cmd(dep, cmd, &params);
+       /*
+        * If the End Transfer command was timed out while the device is
+        * not in SETUP phase, it's possible that an incoming Setup packet
+        * may prevent the command's completion. Let's retry when the
+        * ep0state returns to EP0_SETUP_PHASE.
+        */
+       if (ret == -ETIMEDOUT && dep->dwc->ep0state != EP0_SETUP_PHASE) {
+               dep->flags |= DWC3_EP_DELAY_STOP;
+               return 0;
+       }
        WARN_ON_ONCE(ret);
        dep->resource_index = 0;
 
@@ -3701,7 +3711,7 @@ void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,
         * timeout. Delay issuing the End Transfer command until the Setup TRB is
         * prepared.
         */
-       if (dwc->ep0state != EP0_SETUP_PHASE) {
+       if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) {
                dep->flags |= DWC3_EP_DELAY_STOP;
                return;
        }