A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: dwc3: gadget: Stop processing more requests on IMI

Browse source 
commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream.

When servicing a transfer completion event, the dwc3 driver will reclaim
TRBs of started requests up to the request associated with the interrupt
event. Currently we don't check for interrupt due to missed isoc, and
the driver may attempt to reclaim TRBs beyond the associated event. This
causes invalid memory access when the hardware still owns the TRB. If
there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure
to stop servicing further.

Note that only the last TRB of chained TRBs has its status updated with
missed isoc.

Fixes: 72246da40f ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: [email protected]
Reported-by: Jeff Vanhoof <[email protected]>
Reported-by: Dan Vacura <[email protected]>
Signed-off-by: Thinh Nguyen <[email protected]>
Reviewed-by: Jeff Vanhoof <[email protected]>
Tested-by: Jeff Vanhoof <[email protected]>
Link: https://lore.kernel.org/r/b29acbeab531b666095dfdafd8cb5c7654fbb3e1.1666735451.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This commit is contained in:
Thinh Nguyen 2022-10-25 15:10:14 -07:00 • committed by Greg Kroah-Hartman
commit 9aa0254303
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/usb/dwc3/gadget.c
View file

@ -2681,6 +2681,10 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
if (event->status & DEPEVT_STATUS_SHORT && !chain)
return 1;
if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) &&
DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC)
return 1;
if ((trb->ctrl & DWC3_TRB_CTRL_IOC) ||
(trb->ctrl & DWC3_TRB_CTRL_LST))
return 1;