4.9-stable patches

added patches:
	usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch

diff --git a/queue-4.9/series b/queue-4.9/series
index 85eaa4d3c894f6def964664938c7c4fb63632129..7cf475959e6b02ac99e60b0b463d16cc82c791eb 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -60,3 +60,4 @@ drm-sun4i-add-compatible-string-for-a31-a31s-tcon-timing-controller.patch
 clk-lpc32xx-add-a-quirk-for-pwm-and-ms-clock-dividers.patch
 hid-usbhid-add-quirks-for-mayflash-dragonrise-gamecube-and-ps3-adapters.patch
 hid-i2c-hid-add-a-simple-quirk-to-fix-device-defects.patch
+usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch

diff --git a/queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch b/queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
new file mode 100644 (file)
index 0000000..4b68f68
--- /dev/null
+++ b/queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
@@ -0,0 +1,67 @@
+From de288e36fe33f7e06fa272bc8e2f85aa386d99aa Mon Sep 17 00:00:00 2001
+From: Janusz Dziedzic <januszx.dziedzic@intel.com>
+Date: Mon, 13 Mar 2017 14:11:32 +0200
+Subject: usb: dwc3: gadget: delay unmap of bounced requests
+
+From: Janusz Dziedzic <januszx.dziedzic@intel.com>
+
+commit de288e36fe33f7e06fa272bc8e2f85aa386d99aa upstream.
+
+In the case of bounced ep0 requests, we must delay DMA operation until
+after ->complete() otherwise we might overwrite contents of req->buf.
+
+This caused problems with RNDIS gadget.
+
+Signed-off-by: Janusz Dziedzic <januszx.dziedzic@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c |   21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -174,6 +174,7 @@ void dwc3_gadget_giveback(struct dwc3_ep
+               int status)
+ {
+       struct dwc3                     *dwc = dep->dwc;
++      unsigned int                    unmap_after_complete = false;
+ 
+       req->started = false;
+       list_del(&req->list);
+@@ -182,11 +183,19 @@ void dwc3_gadget_giveback(struct dwc3_ep
+       if (req->request.status == -EINPROGRESS)
+               req->request.status = status;
+ 
+-      if (dwc->ep0_bounced && dep->number <= 1)
++      /*
++       * NOTICE we don't want to unmap before calling ->complete() if we're
++       * dealing with a bounced ep0 request. If we unmap it here, we would end
++       * up overwritting the contents of req->buf and this could confuse the
++       * gadget driver.
++       */
++      if (dwc->ep0_bounced && dep->number <= 1) {
+               dwc->ep0_bounced = false;
+-
+-      usb_gadget_unmap_request(&dwc->gadget, &req->request,
+-                      req->direction);
++              unmap_after_complete = true;
++      } else {
++              usb_gadget_unmap_request(&dwc->gadget,
++                              &req->request, req->direction);
++      }
+ 
+       trace_dwc3_gadget_giveback(req);
+ 
+@@ -194,6 +203,10 @@ void dwc3_gadget_giveback(struct dwc3_ep
+       usb_gadget_giveback_request(&dep->endpoint, &req->request);
+       spin_lock(&dwc->lock);
+ 
++      if (unmap_after_complete)
++              usb_gadget_unmap_request(&dwc->gadget,
++                              &req->request, req->direction);
++
+       if (dep->number > 1)
+               pm_runtime_put(dwc->dev);
+ }