| From c7152763f02e05567da27462b2277a554e507c89 Mon Sep 17 00:00:00 2001 |
| From: Thinh Nguyen <thinh.nguyen@synopsys.com> |
| Date: Tue, 12 Feb 2019 19:39:27 -0800 |
| Subject: usb: dwc3: Reset num_trbs after skipping |
| |
| From: Thinh Nguyen <thinh.nguyen@synopsys.com> |
| |
| commit c7152763f02e05567da27462b2277a554e507c89 upstream. |
| |
| Currently req->num_trbs is not reset after the TRBs are skipped and |
| processed from the cancelled list. The gadget driver may reuse the |
| request with an invalid req->num_trbs, and DWC3 will incorrectly skip |
| trbs. To fix this, simply reset req->num_trbs to 0 after skipping |
| through all of them. |
| |
| Fixes: c3acd5901414 ("usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()") |
| Signed-off-by: Thinh Nguyen <thinhn@synopsys.com> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/dwc3/gadget.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/drivers/usb/dwc3/gadget.c |
| +++ b/drivers/usb/dwc3/gadget.c |
| @@ -1506,6 +1506,8 @@ static void dwc3_gadget_ep_skip_trbs(str |
| trb->ctrl &= ~DWC3_TRB_CTRL_HWO; |
| dwc3_ep_inc_deq(dep); |
| } |
| + |
| + req->num_trbs = 0; |
| } |
| |
| static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep) |
