From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 10 Apr 2017 14:48:19 +0000 (+0200)
Subject: 4.10-stable patches
X-Git-Tag: v4.4.61~25
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=76cdc346c44e615b138af03cff7975af5a15213a;p=thirdparty%2Fkernel%2Fstable-queue.git

4.10-stable patches

added patches:
	usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
---

diff --git a/queue-4.10/series b/queue-4.10/series
index e844264a46c..13e26241a03 100644
--- a/queue-4.10/series
+++ b/queue-4.10/series
@@ -60,3 +60,4 @@ mips-flush-wrong-invalid-ftlb-entry-for-huge-page.patch
 mips-c-r4k-fix-loongson-3-s-vcache-scache-waysize-calculation.patch
 drm-i915-gvt-fix-gvt-scheduler-interval-time.patch
 drm-i915-kvmgt-fix-suspicious-rcu-dereference-usage.patch
+usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
diff --git a/queue-4.10/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch b/queue-4.10/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
new file mode 100644
index 00000000000..203a261aeef
--- /dev/null
+++ b/queue-4.10/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch
@@ -0,0 +1,67 @@
+From de288e36fe33f7e06fa272bc8e2f85aa386d99aa Mon Sep 17 00:00:00 2001
+From: Janusz Dziedzic <januszx.dziedzic@intel.com>
+Date: Mon, 13 Mar 2017 14:11:32 +0200
+Subject: usb: dwc3: gadget: delay unmap of bounced requests
+
+From: Janusz Dziedzic <januszx.dziedzic@intel.com>
+
+commit de288e36fe33f7e06fa272bc8e2f85aa386d99aa upstream.
+
+In the case of bounced ep0 requests, we must delay DMA operation until
+after ->complete() otherwise we might overwrite contents of req->buf.
+
+This caused problems with RNDIS gadget.
+
+Signed-off-by: Janusz Dziedzic <januszx.dziedzic@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c |   21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -171,6 +171,7 @@ void dwc3_gadget_giveback(struct dwc3_ep
+ 		int status)
+ {
+ 	struct dwc3			*dwc = dep->dwc;
++	unsigned int			unmap_after_complete = false;
+ 
+ 	req->started = false;
+ 	list_del(&req->list);
+@@ -180,11 +181,19 @@ void dwc3_gadget_giveback(struct dwc3_ep
+ 	if (req->request.status == -EINPROGRESS)
+ 		req->request.status = status;
+ 
+-	if (dwc->ep0_bounced && dep->number <= 1)
++	/*
++	 * NOTICE we don't want to unmap before calling ->complete() if we're
++	 * dealing with a bounced ep0 request. If we unmap it here, we would end
++	 * up overwritting the contents of req->buf and this could confuse the
++	 * gadget driver.
++	 */
++	if (dwc->ep0_bounced && dep->number <= 1) {
+ 		dwc->ep0_bounced = false;
+-
+-	usb_gadget_unmap_request_by_dev(dwc->sysdev,
+-			&req->request, req->direction);
++		unmap_after_complete = true;
++	} else {
++		usb_gadget_unmap_request_by_dev(dwc->sysdev,
++				&req->request, req->direction);
++	}
+ 
+ 	trace_dwc3_gadget_giveback(req);
+ 
+@@ -192,6 +201,10 @@ void dwc3_gadget_giveback(struct dwc3_ep
+ 	usb_gadget_giveback_request(&dep->endpoint, &req->request);
+ 	spin_lock(&dwc->lock);
+ 
++	if (unmap_after_complete)
++		usb_gadget_unmap_request_by_dev(dwc->sysdev,
++				&req->request, req->direction);
++
+ 	if (dep->number > 1)
+ 		pm_runtime_put(dwc->dev);
+ }