LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Amit Virdi <amit.virdi@st.com>,
	Felipe Balbi <balbi@ti.com>
Subject: [PATCH 3.10 28/50] usb: dwc3: gadget: Stop TRB preparation after limit is reached
Date: Sun, 25 Jan 2015 10:07:18 -0800	[thread overview]
Message-ID: <20150125180704.139923336@linuxfoundation.org> (raw)
In-Reply-To: <20150125180702.521559311@linuxfoundation.org>

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Amit Virdi <amit.virdi@st.com>

commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream.

DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This
means, the max TRBs that can be submitted for an EP is fixed to 32. Since the
request queue for an EP is a linked list, any number of requests can be queued
to it by the gadget layer.  However, the dwc3 driver must not submit TRBs more
than the pool it has created for. This limit wasn't respected when SG was used
resulting in submitting more than the max TRBs, eventually leading to
non-transfer of the TRBs submitted over the max limit.

Root cause:
When SG is used, there are two loops iterating to prepare TRBs:
 - Outer loop over the request_list
 - Inner loop over the SG list
The code was missing break to get out of the outer loop.

Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists)
Signed-off-by: Amit Virdi <amit.virdi@st.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/gadget.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -925,6 +925,9 @@ static void dwc3_prepare_trbs(struct dwc
 				if (last_one)
 					break;
 			}
+
+			if (last_one)
+				break;
 		} else {
 			dma = req->request.dma;
 			length = req->request.length;



  parent reply	other threads:[~2015-01-25 18:09 UTC|newest]

Thread overview: 53+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-01-25 18:06 [PATCH 3.10 00/50] 3.10.66-stable review Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 01/50] netlink: Always copy on mmap TX Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 02/50] netlink: Dont reorder loads/stores before marking mmap netlink frame as available Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 03/50] tg3: tg3_disable_ints using uninitialized mailbox value to disable interrupts Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 04/50] tcp: Do not apply TSO segment limit to non-TSO packets Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 05/50] alx: fix alx_poll() Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 06/50] enic: fix rx skb checksum Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 07/50] drm/vmwgfx: Fix fence event code Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 09/50] drm/radeon: properly filter DP1.2 4k modes on non-DP1.2 hw Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 12/50] ARC: [nsimosci] move peripherals to match model to FPGA Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 13/50] cfg80211: Fix 160 MHz channels with 80+80 and 160 MHz drivers Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 14/50] hp_accel: Add support for HP ZBook 15 Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 15/50] iscsi-target: Fail connection on short sendmsg writes Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 16/50] storvsc: ring buffer failures may result in I/O freeze Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 17/50] video/logo: prevent use of logos after they have been freed Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 18/50] [media] smiapp-pll: Correct clock debug prints Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 20/50] [media] smiapp: Take mutex during PLL update in sensor initialisation Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 21/50] [media] uvcvideo: Fix destruction order in uvc_delete() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 22/50] vfio-pci: Fix the check on pci device type in vfio_pci_probe() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 23/50] ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 24/50] NFSv4.1: Fix client id trunking on Linux Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 25/50] gpiolib: of: Correct error handling in of_get_named_gpiod_flags Greg Kroah-Hartman
2015-01-25 21:31   ` Guenter Roeck
2015-01-25 22:05     ` Greg Kroah-Hartman
2015-01-26  0:29       ` Guenter Roeck
2015-01-26 18:35         ` Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 26/50] OHCI: add a quirk for ULi M5237 blocking on reset Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 27/50] usb: dwc3: gadget: Fix TRB preparation during SG Greg Kroah-Hartman
2015-01-25 18:07 ` Greg Kroah-Hartman [this message]
2015-01-25 18:07 ` [PATCH 3.10 29/50] USB: cp210x: fix ID for production CEL MeshConnect USB Stick Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 30/50] USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 31/50] USB: keyspan: fix null-deref at probe Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 32/50] can: kvaser_usb: Dont free packets when tight on URBs Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 33/50] can: kvaser_usb: Reset all URB tx contexts upon channel close Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 34/50] can: kvaser_usb: Dont send a RESET_CHIP for non-existing channels Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 36/50] Input: I8042 - add Acer Aspire 7738 to the nomux list Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 37/50] ARM: dts: imx25: Fix the SPI1 clocks Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 38/50] ARM: imx6q: drop unnecessary semicolon Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 39/50] ARM: clk-imx6q: fix video divider for rev T0 1.0 Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 40/50] ARM: omap5/dra7xx: Fix frequency typos Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 41/50] ARM: shmobile: sh73a0 legacy: Set .control_parent for all irqpin instances Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 42/50] decompress_bunzip2: off by one in get_next_block() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 43/50] um: Skip futex_atomic_cmpxchg_inatomic() test Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 44/50] x86, um: actually mark system call tables readonly Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 45/50] LOCKD: Fix a race when initialising nlmsvc_timeout Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 46/50] mmc: sdhci: Fix sleep in atomic after inserting SD card Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 47/50] netfilter: ipset: small potential read beyond the end of buffer Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 48/50] fsnotify: next_i is freed during fsnotify_unmount_inodes Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 49/50] s390/3215: fix hanging console issue Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 50/50] s390/3215: fix tty output containing tabs Greg Kroah-Hartman
2015-01-25 20:57 ` [PATCH 3.10 00/50] 3.10.66-stable review Guenter Roeck
2015-01-25 21:35 ` Guenter Roeck
2015-01-26 17:43 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150125180704.139923336@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=amit.virdi@st.com \
    --cc=balbi@ti.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 3.10 28/50] usb: dwc3: gadget: Stop TRB preparation after limit is reached' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).