Patch "usb: dwc3: gadget: Don't delay End Transfer on delayed_status" has been added to the 5.15-stable tree

[<gregkh@xxxxxxxxxxxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    usb: dwc3: gadget: Don't delay End Transfer on delayed_status

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 4db0fbb601361767144e712beb96704b966339f5 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
Date: Tue, 18 Oct 2022 19:39:01 -0700
Subject: usb: dwc3: gadget: Don't delay End Transfer on delayed_status

From: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>

commit 4db0fbb601361767144e712beb96704b966339f5 upstream.

The gadget driver may wait on the request completion when it sets the
USB_GADGET_DELAYED_STATUS. Make sure that the End Transfer command can
go through if the dwc->delayed_status is set so that the request can
complete. When the delayed_status is set, the Setup packet is already
processed, and the next phase should be either Data or Status. It's
unlikely that the host would cancel the control transfer and send a new
Setup packet during End Transfer command. But if that's the case, we can
try again when ep0state returns to EP0_SETUP_PHASE.

Fixes: e1ee843488d5 ("usb: dwc3: gadget: Force sending delayed status during soft disconnect")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
Link: https://lore.kernel.org/r/3f9f59e5d74efcbaee444cf4b30ef639cc7b124e.1666146954.git.Thinh.Nguyen@xxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/dwc3/gadget.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1680,6 +1680,16 @@ static int __dwc3_stop_active_transfer(s
 	cmd |= DWC3_DEPCMD_PARAM(dep->resource_index);
 	memset(&params, 0, sizeof(params));
 	ret = dwc3_send_gadget_ep_cmd(dep, cmd, &params);
+	/*
+	 * If the End Transfer command was timed out while the device is
+	 * not in SETUP phase, it's possible that an incoming Setup packet
+	 * may prevent the command's completion. Let's retry when the
+	 * ep0state returns to EP0_SETUP_PHASE.
+	 */
+	if (ret == -ETIMEDOUT && dep->dwc->ep0state != EP0_SETUP_PHASE) {
+		dep->flags |= DWC3_EP_DELAY_STOP;
+		return 0;
+	}
 	WARN_ON_ONCE(ret);
 	dep->resource_index = 0;
 
@@ -3701,7 +3711,7 @@ void dwc3_stop_active_transfer(struct dw
 	 * timeout. Delay issuing the End Transfer command until the Setup TRB is
 	 * prepared.
 	 */
-	if (dwc->ep0state != EP0_SETUP_PHASE) {
+	if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) {
 		dep->flags |= DWC3_EP_DELAY_STOP;
 		return;
 	}


Patches currently in stable-queue which might be from Thinh.Nguyen@xxxxxxxxxxxx are

queue-5.15/usb-dwc3-gadget-fix-null-pointer-dereference-in-dwc3_gadget_suspend.patch
queue-5.15/usb-dwc3-gadget-refactor-ep0-forced-stall-restart-in.patch
queue-5.15/usb-dwc3-gadget-delay-issuing-end-transfer.patch
queue-5.15/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch
queue-5.15/usb-dwc3-gadget-submit-endxfer-command-if-delayed-du.patch
queue-5.15/usb-dwc3-gadget-execute-gadget-stop-after-halting-the-controller.patch
queue-5.15/usb-dwc3-gadget-only-end-transfer-for-ep0-data-phase.patch
queue-5.15/usb-dwc3-gadget-handle-ep0-request-dequeuing-properl.patch
queue-5.15/usb-dwc3-host-set-xhci_sg_trb_cache_size_quirk.patch
queue-5.15/usb-dwc3-gadget-stall-and-restart-ep0-if-host-is-unr.patch
queue-5.15/usb-dwc3-gadget-force-sending-delayed-status-during-.patch
queue-5.15/usb-dwc3-ep0-don-t-prepare-beyond-setup-stage.patch
queue-5.15/usb-dwc3-gadget-wait-for-ep0-xfers-to-complete-durin.patch