From af1d63c7758b30950d09599ba21aa7573b011007 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Tue, 29 Nov 2022 21:18:36 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- queue-5.10/series | 3 + ...dwc3-gadget-clear-ep-descriptor-last.patch | 56 +++++++++++++ ...gadget-conditionally-remove-requests.patch | 81 +++++++++++++++++++ ...adget-return-eshutdown-on-ep-disable.patch | 39 +++++++++ 4 files changed, 179 insertions(+) create mode 100644 queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch create mode 100644 queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch create mode 100644 queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch diff --git a/queue-5.10/series b/queue-5.10/series index 0de349f8ce5..c029bf25531 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -113,3 +113,6 @@ ceph-put-the-requests-sessions-when-it-fails-to-allo.patch ceph-fix-possible-null-pointer-dereference-for-req-r.patch ceph-use-kcalloc-for-allocating-multiple-elements.patch ceph-fix-null-pointer-dereference-for-req-r_session.patch +usb-dwc3-gadget-conditionally-remove-requests.patch +usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch +usb-dwc3-gadget-clear-ep-descriptor-last.patch diff --git a/queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch b/queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch new file mode 100644 index 00000000000..a0636771d57 --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-clear-ep-descriptor-last.patch @@ -0,0 +1,56 @@ +From 641577605f24afa9bdc69f004f471bb7da976520 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 17:19:43 -0800 +Subject: usb: dwc3: gadget: Clear ep descriptor last + +From: Thinh Nguyen + +[ Upstream commit f90f5afd5083a7cb4aee13bd4cc0ae600bd381ca ] + +Until the endpoint is disabled, its descriptors should remain valid. +When its requests are removed from ep disable, the request completion +routine may attempt to access the endpoint's descriptor. Don't clear the +descriptors before that. + +Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/45db7c83b209259115bf652af210f8b2b3b1a383.1668561364.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 2b4e1c0d02d5..a9a43d649478 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -803,18 +803,18 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) + reg &= ~DWC3_DALEPENA_EP(dep->number); + dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); + +- /* Clear out the ep descriptors for non-ep0 */ +- if (dep->number > 1) { +- dep->endpoint.comp_desc = NULL; +- dep->endpoint.desc = NULL; +- } +- + dwc3_remove_requests(dwc, dep, -ESHUTDOWN); + + dep->stream_capable = false; + dep->type = 0; + dep->flags = 0; + ++ /* Clear out the ep descriptors for non-ep0 */ ++ if (dep->number > 1) { ++ dep->endpoint.comp_desc = NULL; ++ dep->endpoint.desc = NULL; ++ } ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch b/queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch new file mode 100644 index 00000000000..89c50789a33 --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-conditionally-remove-requests.patch @@ -0,0 +1,81 @@ +From 0e0e96ef9260ee14cbf24ae6b8aaf3b6d31a10bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 23:35:23 +0200 +Subject: usb: dwc3: gadget: conditionally remove requests + +From: Michael Grzeschik + +[ Upstream commit b44c0e7fef51ee7e8ca8c6efbf706f5613787100 ] + +The functions stop_active_transfers and ep_disable are both calling +remove_requests. This functions in both cases will giveback the requests +with status ESHUTDOWN, which also represents an physical disconnection. +For ep_disable this is not true. This patch adds the status parameter to +remove_requests and sets the status to ECONNRESET on ep_disable. + +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220720213523.1055897-1-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f90f5afd5083 ("usb: dwc3: gadget: Clear ep descriptor last") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 347ba7e4bd81..c753d889ae1c 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -752,7 +752,7 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, unsigned int action) + return 0; + } + +-static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep) ++static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep, int status) + { + struct dwc3_request *req; + +@@ -762,19 +762,19 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep) + while (!list_empty(&dep->started_list)) { + req = next_request(&dep->started_list); + +- dwc3_gadget_giveback(dep, req, -ESHUTDOWN); ++ dwc3_gadget_giveback(dep, req, status); + } + + while (!list_empty(&dep->pending_list)) { + req = next_request(&dep->pending_list); + +- dwc3_gadget_giveback(dep, req, -ESHUTDOWN); ++ dwc3_gadget_giveback(dep, req, status); + } + + while (!list_empty(&dep->cancelled_list)) { + req = next_request(&dep->cancelled_list); + +- dwc3_gadget_giveback(dep, req, -ESHUTDOWN); ++ dwc3_gadget_giveback(dep, req, status); + } + } + +@@ -809,7 +809,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) + dep->endpoint.desc = NULL; + } + +- dwc3_remove_requests(dwc, dep); ++ dwc3_remove_requests(dwc, dep, -ECONNRESET); + + dep->stream_capable = false; + dep->type = 0; +@@ -2067,7 +2067,7 @@ static void dwc3_stop_active_transfers(struct dwc3 *dwc) + if (!dep) + continue; + +- dwc3_remove_requests(dwc, dep); ++ dwc3_remove_requests(dwc, dep, -ESHUTDOWN); + } + } + +-- +2.35.1 + diff --git a/queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch b/queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch new file mode 100644 index 00000000000..db85e510d94 --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-return-eshutdown-on-ep-disable.patch @@ -0,0 +1,39 @@ +From 6db13cca420a9d3bac04acd9f50a7f3368999701 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 18:45:44 -0800 +Subject: usb: dwc3: gadget: Return -ESHUTDOWN on ep disable + +From: Thinh Nguyen + +[ Upstream commit ffb9da4a04c69567bad717707b6fdfbc4c216ef4 ] + +The usb_request API clearly noted that removed requests due to disabled +endpoint should have -ESHUTDOWN status returned. Don't change this +behavior. + +Fixes: b44c0e7fef51 ("usb: dwc3: gadget: conditionally remove requests") +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/3421859485cb32d77e2068549679a6c07a7797bc.1667875427.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: f90f5afd5083 ("usb: dwc3: gadget: Clear ep descriptor last") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index c753d889ae1c..2b4e1c0d02d5 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -809,7 +809,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) + dep->endpoint.desc = NULL; + } + +- dwc3_remove_requests(dwc, dep, -ECONNRESET); ++ dwc3_remove_requests(dwc, dep, -ESHUTDOWN); + + dep->stream_capable = false; + dep->type = 0; +-- +2.35.1 + -- 2.47.3