From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.7 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE05EC282C7 for ; Sat, 26 Jan 2019 18:21:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7DB0C218A6 for ; Sat, 26 Jan 2019 18:21:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548526865; bh=ywxMvaYGSsRj32T9Eu/bMbTBnycaj3DiwvdSxWOWlIU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=yXsw41gGgA+jG8wZzxtJY5UPri77yVSB0rogwpmUT9BEbUgH1A3r0jdPhEOV6jy3+ Dhs/ykkyj5N5gnXZjM1d16Mdw+jgEU212+nSsjhXMLHiOfbxAmNEFZVrAe1Cp0SO5m i/Iqqg4xfG7M7Ea4h/8XXn3Ooz0idjCL/7bwAt4s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726106AbfAZSVF (ORCPT ); Sat, 26 Jan 2019 13:21:05 -0500 Received: from mail.kernel.org ([198.145.29.99]:39214 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726073AbfAZSVE (ORCPT ); Sat, 26 Jan 2019 13:21:04 -0500 Received: from localhost (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BECF72184C; Sat, 26 Jan 2019 18:21:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548526864; bh=ywxMvaYGSsRj32T9Eu/bMbTBnycaj3DiwvdSxWOWlIU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=u28oyxDxumkQZ2UfDvAQnBSY2y2S5jlARKpSQZtT57K4VVFFcQJkkAyeVIcH4ffVK 6TCKWr6edG7bq2nW9Jtbs4L+mrKG4Pt3qDkN1u5pgErndbu/++wMYBc47O4v39TgeY 3SE+Gu+9qCuRaiSY6MAKfKKuYiVfAYgkq8dLpZqI= Date: Sat, 26 Jan 2019 13:21:02 -0500 From: Sasha Levin To: Jack Pham Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Felipe Balbi Subject: Re: [PATCH 4.14,4.19,4.20] usb: dwc3: gadget: Clear req->unaligned and zero flags on cleanup Message-ID: <20190126182102.GG30183@sasha-vm> References: <20190126011816.GD23243@jackp-linux.qualcomm.com> <20190126015153.2757-1-jackp@codeaurora.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <20190126015153.2757-1-jackp@codeaurora.org> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Fri, Jan 25, 2019 at 05:51:53PM -0800, Jack Pham wrote: >commit bd6742249b9ca918565e4e3abaa06665e587f4b5 upstream. > >OUT endpoint requests may somtimes have one of these flags set >when preparing to be submitted to HW indicating that there is an >additional TRB chained to the request for alignment purposes. >If that request is removed before the controller can execute the >transfer (e.g. ep_dequeue/ep_disable), the request will not go >through the dwc3_gadget_ep_cleanup_completed_request() handler >and will not have its unaligned or zero flag cleared when >dwc3_gadget_giveback() is called. This same request could be >later requeued for a new transfer that does not require an >extra TRB and if it is successfully completed, the cleanup >and TRB reclamation will incorrectly process the additional TRB >which belongs to the next request, and incorrectly advances the >TRB dequeue pointer, thereby messing up calculation of the next >requeust's actual/remaining count when it completes. > >The right thing to do here is to ensure that the flags are cleared >before it is given back to the function driver. A good place >to do that is in dwc3_gadget_del_and_unmap_request(). > >Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize") >Signed-off-by: Jack Pham >Signed-off-by: Felipe Balbi >[jackp: backport to <= 4.20: replaced 'needs_extra_trb' with 'unaligned' > and 'zero' members in patch and reworded commit text] >Signed-off-by: Jack Pham >--- > drivers/usb/dwc3/gadget.c | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c >index 9f92ee03dde7..2a4ea9a1b1e3 100644 >--- a/drivers/usb/dwc3/gadget.c >+++ b/drivers/usb/dwc3/gadget.c >@@ -177,6 +177,8 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep, > req->started = false; > list_del(&req->list); > req->remaining = 0; >+ req->unaligned = false; >+ req->zero = false; > > if (req->request.status == -EINPROGRESS) > req->request.status = status; Thanks! I'll let Greg pick it up (as the upstream patch was explicitly tagged for stable). -- Thanks, Sasha