diff options
| author | Thinh Nguyen <thinh.nguyen@synopsys.com> | 2019-02-12 19:39:27 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-03 13:14:49 +0200 |
| commit | 9c423fd89a2b8624ca0a0eb2a1bd440ad0db8cf5 (patch) | |
| tree | cc58d2e49b42c65c81ad304372b031a2a48c010f | |
| parent | 2bbb6b547fbe43cf6cbfdbb9e964c4ca51fed8eb (diff) | |
| download | linux-stable-9c423fd89a2b8624ca0a0eb2a1bd440ad0db8cf5.tar.gz | |
usb: dwc3: Reset num_trbs after skipping
commit c7152763f02e05567da27462b2277a554e507c89 upstream.
Currently req->num_trbs is not reset after the TRBs are skipped and
processed from the cancelled list. The gadget driver may reuse the
request with an invalid req->num_trbs, and DWC3 will incorrectly skip
trbs. To fix this, simply reset req->num_trbs to 0 after skipping
through all of them.
Fixes: c3acd5901414 ("usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: Sasha Levin <sashal@kernel.org>
Cc: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/dwc3/gadget.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index e7122b5199d23..e7461c995116a 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1361,6 +1361,8 @@ static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *r trb->ctrl &= ~DWC3_TRB_CTRL_HWO; dwc3_ep_inc_deq(dep); } + + req->num_trbs = 0; } static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep) |