From 9bbf14ffb64de932f24606dca4b77884ca9e025a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 10 Apr 2017 17:33:27 +0200 Subject: [PATCH] 4.9-stable patches added patches: usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch --- queue-4.9/series | 1 + ...dget-delay-unmap-of-bounced-requests.patch | 67 +++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch diff --git a/queue-4.9/series b/queue-4.9/series index 85eaa4d3c89..7cf475959e6 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -60,3 +60,4 @@ drm-sun4i-add-compatible-string-for-a31-a31s-tcon-timing-controller.patch clk-lpc32xx-add-a-quirk-for-pwm-and-ms-clock-dividers.patch hid-usbhid-add-quirks-for-mayflash-dragonrise-gamecube-and-ps3-adapters.patch hid-i2c-hid-add-a-simple-quirk-to-fix-device-defects.patch +usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch diff --git a/queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch b/queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch new file mode 100644 index 00000000000..4b68f682121 --- /dev/null +++ b/queue-4.9/usb-dwc3-gadget-delay-unmap-of-bounced-requests.patch @@ -0,0 +1,67 @@ +From de288e36fe33f7e06fa272bc8e2f85aa386d99aa Mon Sep 17 00:00:00 2001 +From: Janusz Dziedzic +Date: Mon, 13 Mar 2017 14:11:32 +0200 +Subject: usb: dwc3: gadget: delay unmap of bounced requests + +From: Janusz Dziedzic + +commit de288e36fe33f7e06fa272bc8e2f85aa386d99aa upstream. + +In the case of bounced ep0 requests, we must delay DMA operation until +after ->complete() otherwise we might overwrite contents of req->buf. + +This caused problems with RNDIS gadget. + +Signed-off-by: Janusz Dziedzic +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -174,6 +174,7 @@ void dwc3_gadget_giveback(struct dwc3_ep + int status) + { + struct dwc3 *dwc = dep->dwc; ++ unsigned int unmap_after_complete = false; + + req->started = false; + list_del(&req->list); +@@ -182,11 +183,19 @@ void dwc3_gadget_giveback(struct dwc3_ep + if (req->request.status == -EINPROGRESS) + req->request.status = status; + +- if (dwc->ep0_bounced && dep->number <= 1) ++ /* ++ * NOTICE we don't want to unmap before calling ->complete() if we're ++ * dealing with a bounced ep0 request. If we unmap it here, we would end ++ * up overwritting the contents of req->buf and this could confuse the ++ * gadget driver. ++ */ ++ if (dwc->ep0_bounced && dep->number <= 1) { + dwc->ep0_bounced = false; +- +- usb_gadget_unmap_request(&dwc->gadget, &req->request, +- req->direction); ++ unmap_after_complete = true; ++ } else { ++ usb_gadget_unmap_request(&dwc->gadget, ++ &req->request, req->direction); ++ } + + trace_dwc3_gadget_giveback(req); + +@@ -194,6 +203,10 @@ void dwc3_gadget_giveback(struct dwc3_ep + usb_gadget_giveback_request(&dep->endpoint, &req->request); + spin_lock(&dwc->lock); + ++ if (unmap_after_complete) ++ usb_gadget_unmap_request(&dwc->gadget, ++ &req->request, req->direction); ++ + if (dep->number > 1) + pm_runtime_put(dwc->dev); + } -- 2.47.3