Thinh Nguyen <Thinh.Nguyen@synopsys.com> writes:

> The driver incorrectly uses req->num_pending_sgs to track both the
> number of pending and queued SG entries. It only prepares the next
> request if the previous is done, and it doesn't update num_pending_sgs
> until there is TRB completion interrupt. This may starve the controller
> of more TRBs until the num_pending_sgs is decremented.
>
> Fix this by decrementing the num_pending_sgs after they are queued and
> properly track both num_mapped_sgs and num_queued_sgs.
>
> Cc: <stable@vger.kernel.org>
> Tested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
> Reported-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
> Fixes: c96e6725db9d ("usb: dwc3: gadget: Correct the logic for queuing sgs")
> Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

Acked-by: Felipe Balbi <balbi@kernel.org>

-- 
balbi