Patch "usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-dwc2-gadget-don-t-write-invalid-mapped-sg-entrie.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a6d85a482ea65e8739b0334403da8905445cef18
Author: Peng Hongchi <hongchi.peng@xxxxxxxxxxxx>
Date:   Sun Jul 28 12:08:46 2024 -0400

    usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled
    
    [ Upstream commit 1134289b6b93d73721340b66c310fd985385e8fa ]
    
    When using dma_map_sg() to map the scatterlist with iommu enabled,
    the entries in the scatterlist can be mergerd into less but longer
    entries in the function __finalise_sg(). So that the number of
    valid mapped entries is actually smaller than ureq->num_reqs,and
    there are still some invalid entries in the scatterlist with
    dma_addr=0xffffffff and len=0. Writing these invalid sg entries
    into the dma_desc can cause a data transmission error.
    
    The function dma_map_sg() returns the number of valid map entries
    and the return value is assigned to usb_request::num_mapped_sgs in
    function usb_gadget_map_request_by_dev(). So that just write valid
    mapped entries into dma_desc according to the usb_request::num_mapped_sgs,
    and set the IOC bit if it's the last valid mapped entry.
    
    This patch poses no risk to no-iommu situation, cause
    ureq->num_mapped_sgs equals ureq->num_sgs while using dma_direct_map_sg()
    to map the scatterlist whith iommu disabled.
    
    Signed-off-by: Peng Hongchi <hongchi.peng@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240523100315.7226-1-hongchi.peng@xxxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index f6b2a4f2e59d..4422da561365 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -886,10 +886,10 @@ static void dwc2_gadget_config_nonisoc_xfer_ddma(struct dwc2_hsotg_ep *hs_ep,
 	}
 
 	/* DMA sg buffer */
-	for_each_sg(ureq->sg, sg, ureq->num_sgs, i) {
+	for_each_sg(ureq->sg, sg, ureq->num_mapped_sgs, i) {
 		dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &desc,
 			sg_dma_address(sg) + sg->offset, sg_dma_len(sg),
-			sg_is_last(sg));
+			(i == (ureq->num_mapped_sgs - 1)));
 		desc_count += hs_ep->desc_count;
 	}