5.4-stable patches

added patches:
	usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch

diff --git a/queue-5.4/series b/queue-5.4/series
index f191f7a0bb3120705fa04eedb5704c9a606e27cb..f23050f8401dd4fade29a2713f22a561f7ce0e26 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -173,3 +173,4 @@ alsa-hda-realtek-update-alc225-depop-procedure.patch
 alsa-hda-realtek-set-pcbeep-to-default-value-for-alc274.patch
 alsa-hda-realtek-fix-internal-speaker-and-mic-boost-of-infinix-y4-max.patch
 alsa-hda-realtek-apply-quirk-for-medion-e15433.patch
+usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch

diff --git a/queue-5.4/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch b/queue-5.4/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch
new file mode 100644 (file)
index 0000000..ba651c2
--- /dev/null
+++ b/queue-5.4/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch
@@ -0,0 +1,53 @@
+From 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 14 Nov 2024 01:02:12 +0000
+Subject: usb: dwc3: gadget: Fix checking for number of TRBs left
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 upstream.
+
+The check whether the TRB ring is full or empty in dwc3_calc_trbs_left()
+is insufficient. It assumes there are active TRBs if there's any request
+in the started_list. However, that's not the case for requests with a
+large SG list.
+
+That is, if we have a single usb request that requires more TRBs than
+the total TRBs in the TRB ring, the queued TRBs will be available when
+all the TRBs in the ring are completed. But the request is only
+partially completed and remains in the started_list. With the current
+logic, the TRB ring is empty, but dwc3_calc_trbs_left() returns 0.
+
+Fix this by additionally checking for the request->num_trbs for active
+TRB count.
+
+Cc: stable@vger.kernel.org
+Fixes: 51f1954ad853 ("usb: dwc3: gadget: Fix dwc3_calc_trbs_left()")
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/708dc62b56b77da1f704cc2ae9b6ddb1f2dbef1f.1731545781.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -903,11 +903,14 @@ static u32 dwc3_calc_trbs_left(struct dw
+        * pending to be processed by the driver.
+        */
+       if (dep->trb_enqueue == dep->trb_dequeue) {
++              struct dwc3_request *req;
++
+               /*
+-               * If there is any request remained in the started_list at
+-               * this point, that means there is no TRB available.
++               * If there is any request remained in the started_list with
++               * active TRBs at this point, then there is no TRB available.
+                */
+-              if (!list_empty(&dep->started_list))
++              req = next_request(&dep->started_list);
++              if (req && req->num_trbs)
+                       return 0;
+ 
+               return DWC3_TRB_NUM - 1;