From: Pawel Laszczak <pawell@xxxxxxxxxxx>
commit b3fa25de31fb7e9afebe9599b8ff32eda13d7c94 upstream.
Path fixes bug which occurs during resetting endpoint in
__cdns3_gadget_ep_clear_halt function. During resetting endpoint
controller will change HW/DMA owned TRB. It set Abort flag in
trb->control and will change trb->length field. If driver want
to use the aborted trb it must update the changed field in
TRB.
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
cc: <stable@xxxxxxxxxxxxxxx>
Acked-by: Peter Chen <peter.chen@xxxxxxxxxx>
Signed-off-by: Pawel Laszczak <pawell@xxxxxxxxxxx>
Link: https://lore.kernel.org/r/20220329084605.4022-1-pawell@xxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/cdns3/gadget.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/cdns3/gadget.c
+++ b/drivers/usb/cdns3/gadget.c
@@ -2166,6 +2166,7 @@ int __cdns3_gadget_ep_clear_halt(struct
struct usb_request *request;
struct cdns3_request *priv_req;
struct cdns3_trb *trb = NULL;
+ struct cdns3_trb trb_tmp;
int ret;
int val;
@@ -2175,8 +2176,10 @@ int __cdns3_gadget_ep_clear_halt(struct
if (request) {
priv_req = to_cdns3_request(request);
trb = priv_req->trb;
- if (trb)
+ if (trb) {
+ trb_tmp = *trb;
trb->control = trb->control ^ TRB_CYCLE;
+ }
}
writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd);
@@ -2191,7 +2194,8 @@ int __cdns3_gadget_ep_clear_halt(struct
if (request) {
if (trb)
- trb->control = trb->control ^ TRB_CYCLE;
+ *trb = trb_tmp;
+
cdns3_rearm_transfer(priv_ep, 1);
}
