From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6C8EC282C0 for ; Sat, 26 Jan 2019 01:52:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A793021855 for ; Sat, 26 Jan 2019 01:52:15 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="eX/3EzU9"; dkim=fail reason="key not found in DNS" (0-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="YaFlkfpY" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727740AbfAZBwP (ORCPT ); Fri, 25 Jan 2019 20:52:15 -0500 Received: from smtp.codeaurora.org ([198.145.29.96]:38400 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725550AbfAZBwO (ORCPT ); Fri, 25 Jan 2019 20:52:14 -0500 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 01526601CF; Sat, 26 Jan 2019 01:52:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1548467534; bh=wzb1e3wR5U4mMlKZdx8O6Y30YZ94ahsD0Gz0LEhi+FU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eX/3EzU9S8pYOGXATBFMzawiw57WpT71NJsZMWlsBi5sVFk6WMDa1OWyAD6hm0khp MZxqkzMvmqdBNlYU7XkyjAvV5INtfa2aoZGVKGBkOd3jLRFSSxBf/H9M5KkkeerBEt lkLqAo0l+T7nH0ue6lxtwh7pRljbsz8ozstuqlCk= Received: from jackp-linux.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: jackp@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id F0DC9601CF; Sat, 26 Jan 2019 01:52:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1548467533; bh=wzb1e3wR5U4mMlKZdx8O6Y30YZ94ahsD0Gz0LEhi+FU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YaFlkfpYoQiHocAtdXTNPJxi9SI/upA3Njb/TmXLq755/r44dByd+5KHJtM7Ke/L5 YhyZpJAB/3CWCTsxwnR6DZp2JiYfo5gsRjySxOd4pRqBOllu4EtW4DQA7C6mwbenMo xlxlO48msQaVTKHgaFk2xYNg/AP8PNvViHdTe4xQ= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org F0DC9601CF Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=jackp@codeaurora.org From: Jack Pham To: Sasha Levin , Greg Kroah-Hartman Cc: stable@vger.kernel.org, Jack Pham , Felipe Balbi Subject: [PATCH 4.14,4.19,4.20] usb: dwc3: gadget: Clear req->unaligned and zero flags on cleanup Date: Fri, 25 Jan 2019 17:51:53 -0800 Message-Id: <20190126015153.2757-1-jackp@codeaurora.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190126011816.GD23243@jackp-linux.qualcomm.com> References: <20190126011816.GD23243@jackp-linux.qualcomm.com> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org commit bd6742249b9ca918565e4e3abaa06665e587f4b5 upstream. OUT endpoint requests may somtimes have one of these flags set when preparing to be submitted to HW indicating that there is an additional TRB chained to the request for alignment purposes. If that request is removed before the controller can execute the transfer (e.g. ep_dequeue/ep_disable), the request will not go through the dwc3_gadget_ep_cleanup_completed_request() handler and will not have its unaligned or zero flag cleared when dwc3_gadget_giveback() is called. This same request could be later requeued for a new transfer that does not require an extra TRB and if it is successfully completed, the cleanup and TRB reclamation will incorrectly process the additional TRB which belongs to the next request, and incorrectly advances the TRB dequeue pointer, thereby messing up calculation of the next requeust's actual/remaining count when it completes. The right thing to do here is to ensure that the flags are cleared before it is given back to the function driver. A good place to do that is in dwc3_gadget_del_and_unmap_request(). Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize") Signed-off-by: Jack Pham Signed-off-by: Felipe Balbi [jackp: backport to <= 4.20: replaced 'needs_extra_trb' with 'unaligned' and 'zero' members in patch and reworded commit text] Signed-off-by: Jack Pham --- drivers/usb/dwc3/gadget.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 9f92ee03dde7..2a4ea9a1b1e3 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -177,6 +177,8 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep, req->started = false; list_del(&req->list); req->remaining = 0; + req->unaligned = false; + req->zero = false; if (req->request.status == -EINPROGRESS) req->request.status = status; -- 2.17.0