4.19-stable patches

added patches:
	usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch

diff --git a/queue-4.19/series b/queue-4.19/series
index 6dcf0911c7d2203baab58b3f34393d71c1b0c532..4a9a87aaf07d382bde1c2a6de33de7667519453a 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -121,3 +121,4 @@ arm64-tls-fix-context-switching-of-tpidrro_el0-when-kpti-is-enabled.patch
 block-fix-ordering-between-checking-blk_mq_s_stopped-request-adding.patch
 hid-wacom-interpret-tilt-data-from-intuos-pro-bt-as-signed-values.patch
 media-wl128x-fix-atomicity-violation-in-fmc_send_cmd.patch
+usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch

diff --git a/queue-4.19/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch b/queue-4.19/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch
new file mode 100644 (file)
index 0000000..ba651c2
--- /dev/null
+++ b/queue-4.19/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch
@@ -0,0 +1,53 @@
+From 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 14 Nov 2024 01:02:12 +0000
+Subject: usb: dwc3: gadget: Fix checking for number of TRBs left
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 upstream.
+
+The check whether the TRB ring is full or empty in dwc3_calc_trbs_left()
+is insufficient. It assumes there are active TRBs if there's any request
+in the started_list. However, that's not the case for requests with a
+large SG list.
+
+That is, if we have a single usb request that requires more TRBs than
+the total TRBs in the TRB ring, the queued TRBs will be available when
+all the TRBs in the ring are completed. But the request is only
+partially completed and remains in the started_list. With the current
+logic, the TRB ring is empty, but dwc3_calc_trbs_left() returns 0.
+
+Fix this by additionally checking for the request->num_trbs for active
+TRB count.
+
+Cc: stable@vger.kernel.org
+Fixes: 51f1954ad853 ("usb: dwc3: gadget: Fix dwc3_calc_trbs_left()")
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/708dc62b56b77da1f704cc2ae9b6ddb1f2dbef1f.1731545781.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -903,11 +903,14 @@ static u32 dwc3_calc_trbs_left(struct dw
+        * pending to be processed by the driver.
+        */
+       if (dep->trb_enqueue == dep->trb_dequeue) {
++              struct dwc3_request *req;
++
+               /*
+-               * If there is any request remained in the started_list at
+-               * this point, that means there is no TRB available.
++               * If there is any request remained in the started_list with
++               * active TRBs at this point, then there is no TRB available.
+                */
+-              if (!list_empty(&dep->started_list))
++              req = next_request(&dep->started_list);
++              if (req && req->num_trbs)
+                       return 0;
+ 
+               return DWC3_TRB_NUM - 1;