Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/series b/queue-5.10/series
index 0de349f8ce57598669e5cc8fc6a00a918bf1a2f4..c029bf25531838f64306dc0003655db9fb3d3117 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -113,3 +113,6 @@ ceph-put-the-requests-sessions-when-it-fails-to-allo.patch
 ceph-fix-possible-null-pointer-dereference-for-req-r.patch
 ceph-use-kcalloc-for-allocating-multiple-elements.patch
 ceph-fix-null-pointer-dereference-for-req-r_session.patch
+usb-dwc3-gadget-conditionally-remove-requests.patch
+usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch
+usb-dwc3-gadget-clear-ep-descriptor-last.patch

diff --git a/queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch b/queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch
new file mode 100644 (file)
index 0000000..a063677
--- /dev/null
+++ b/queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch
@@ -0,0 +1,56 @@
+From 641577605f24afa9bdc69f004f471bb7da976520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 17:19:43 -0800
+Subject: usb: dwc3: gadget: Clear ep descriptor last
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit f90f5afd5083a7cb4aee13bd4cc0ae600bd381ca ]
+
+Until the endpoint is disabled, its descriptors should remain valid.
+When its requests are removed from ep disable, the request completion
+routine may attempt to access the endpoint's descriptor. Don't clear the
+descriptors before that.
+
+Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/45db7c83b209259115bf652af210f8b2b3b1a383.1668561364.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 2b4e1c0d02d5..a9a43d649478 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -803,18 +803,18 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
+       reg &= ~DWC3_DALEPENA_EP(dep->number);
+       dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
+ 
+-      /* Clear out the ep descriptors for non-ep0 */
+-      if (dep->number > 1) {
+-              dep->endpoint.comp_desc = NULL;
+-              dep->endpoint.desc = NULL;
+-      }
+-
+       dwc3_remove_requests(dwc, dep, -ESHUTDOWN);
+ 
+       dep->stream_capable = false;
+       dep->type = 0;
+       dep->flags = 0;
+ 
++      /* Clear out the ep descriptors for non-ep0 */
++      if (dep->number > 1) {
++              dep->endpoint.comp_desc = NULL;
++              dep->endpoint.desc = NULL;
++      }
++
+       return 0;
+ }
+ 
+-- 
+2.35.1
+

diff --git a/queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch b/queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch
new file mode 100644 (file)
index 0000000..89c5078
--- /dev/null
+++ b/queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch
@@ -0,0 +1,81 @@
+From 0e0e96ef9260ee14cbf24ae6b8aaf3b6d31a10bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 23:35:23 +0200
+Subject: usb: dwc3: gadget: conditionally remove requests
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+[ Upstream commit b44c0e7fef51ee7e8ca8c6efbf706f5613787100 ]
+
+The functions stop_active_transfers and ep_disable are both calling
+remove_requests. This functions in both cases will giveback the requests
+with status ESHUTDOWN, which also represents an physical disconnection.
+For ep_disable this is not true. This patch adds the status parameter to
+remove_requests and sets the status to ECONNRESET on ep_disable.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Link: https://lore.kernel.org/r/20220720213523.1055897-1-m.grzeschik@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f90f5afd5083 ("usb: dwc3: gadget: Clear ep descriptor last")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 347ba7e4bd81..c753d889ae1c 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -752,7 +752,7 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, unsigned int action)
+       return 0;
+ }
+ 
+-static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
++static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep, int status)
+ {
+       struct dwc3_request             *req;
+ 
+@@ -762,19 +762,19 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
+       while (!list_empty(&dep->started_list)) {
+               req = next_request(&dep->started_list);
+ 
+-              dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
++              dwc3_gadget_giveback(dep, req, status);
+       }
+ 
+       while (!list_empty(&dep->pending_list)) {
+               req = next_request(&dep->pending_list);
+ 
+-              dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
++              dwc3_gadget_giveback(dep, req, status);
+       }
+ 
+       while (!list_empty(&dep->cancelled_list)) {
+               req = next_request(&dep->cancelled_list);
+ 
+-              dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
++              dwc3_gadget_giveback(dep, req, status);
+       }
+ }
+ 
+@@ -809,7 +809,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
+               dep->endpoint.desc = NULL;
+       }
+ 
+-      dwc3_remove_requests(dwc, dep);
++      dwc3_remove_requests(dwc, dep, -ECONNRESET);
+ 
+       dep->stream_capable = false;
+       dep->type = 0;
+@@ -2067,7 +2067,7 @@ static void dwc3_stop_active_transfers(struct dwc3 *dwc)
+               if (!dep)
+                       continue;
+ 
+-              dwc3_remove_requests(dwc, dep);
++              dwc3_remove_requests(dwc, dep, -ESHUTDOWN);
+       }
+ }
+ 
+-- 
+2.35.1
+

diff --git a/queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch b/queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch
new file mode 100644 (file)
index 0000000..db85e51
--- /dev/null
+++ b/queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch
@@ -0,0 +1,39 @@
+From 6db13cca420a9d3bac04acd9f50a7f3368999701 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Nov 2022 18:45:44 -0800
+Subject: usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit ffb9da4a04c69567bad717707b6fdfbc4c216ef4 ]
+
+The usb_request API clearly noted that removed requests due to disabled
+endpoint should have -ESHUTDOWN status returned. Don't change this
+behavior.
+
+Fixes: b44c0e7fef51 ("usb: dwc3: gadget: conditionally remove requests")
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/3421859485cb32d77e2068549679a6c07a7797bc.1667875427.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f90f5afd5083 ("usb: dwc3: gadget: Clear ep descriptor last")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index c753d889ae1c..2b4e1c0d02d5 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -809,7 +809,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
+               dep->endpoint.desc = NULL;
+       }
+ 
+-      dwc3_remove_requests(dwc, dep, -ECONNRESET);
++      dwc3_remove_requests(dwc, dep, -ESHUTDOWN);
+ 
+       dep->stream_capable = false;
+       dep->type = 0;
+-- 
+2.35.1
+