From: Greg Kroah-Hartman Date: Tue, 3 Dec 2024 10:54:51 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.19.325~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fd0f7ddc53cea2cb70884c6f6ee9fa667dcb7d61;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch --- diff --git a/queue-5.4/series b/queue-5.4/series index f191f7a0bb3..f23050f8401 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -173,3 +173,4 @@ alsa-hda-realtek-update-alc225-depop-procedure.patch alsa-hda-realtek-set-pcbeep-to-default-value-for-alc274.patch alsa-hda-realtek-fix-internal-speaker-and-mic-boost-of-infinix-y4-max.patch alsa-hda-realtek-apply-quirk-for-medion-e15433.patch +usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch diff --git a/queue-5.4/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch b/queue-5.4/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch new file mode 100644 index 00000000000..ba651c22a21 --- /dev/null +++ b/queue-5.4/usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch @@ -0,0 +1,53 @@ +From 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 14 Nov 2024 01:02:12 +0000 +Subject: usb: dwc3: gadget: Fix checking for number of TRBs left + +From: Thinh Nguyen + +commit 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 upstream. + +The check whether the TRB ring is full or empty in dwc3_calc_trbs_left() +is insufficient. It assumes there are active TRBs if there's any request +in the started_list. However, that's not the case for requests with a +large SG list. + +That is, if we have a single usb request that requires more TRBs than +the total TRBs in the TRB ring, the queued TRBs will be available when +all the TRBs in the ring are completed. But the request is only +partially completed and remains in the started_list. With the current +logic, the TRB ring is empty, but dwc3_calc_trbs_left() returns 0. + +Fix this by additionally checking for the request->num_trbs for active +TRB count. + +Cc: stable@vger.kernel.org +Fixes: 51f1954ad853 ("usb: dwc3: gadget: Fix dwc3_calc_trbs_left()") +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/708dc62b56b77da1f704cc2ae9b6ddb1f2dbef1f.1731545781.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -903,11 +903,14 @@ static u32 dwc3_calc_trbs_left(struct dw + * pending to be processed by the driver. + */ + if (dep->trb_enqueue == dep->trb_dequeue) { ++ struct dwc3_request *req; ++ + /* +- * If there is any request remained in the started_list at +- * this point, that means there is no TRB available. ++ * If there is any request remained in the started_list with ++ * active TRBs at this point, then there is no TRB available. + */ +- if (!list_empty(&dep->started_list)) ++ req = next_request(&dep->started_list); ++ if (req && req->num_trbs) + return 0; + + return DWC3_TRB_NUM - 1;