This is a note to let you know that I've just added the patch titled usb: dwc3: gadget: Stop TRB preparation after limit is reached to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 39e60635a01520e8c8ed3946a28c2b98e6a46f79 Mon Sep 17 00:00:00 2001 From: Amit Virdi <amit.virdi@xxxxxx> Date: Tue, 13 Jan 2015 14:27:21 +0530 Subject: usb: dwc3: gadget: Stop TRB preparation after limit is reached From: Amit Virdi <amit.virdi@xxxxxx> commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream. DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This means, the max TRBs that can be submitted for an EP is fixed to 32. Since the request queue for an EP is a linked list, any number of requests can be queued to it by the gadget layer. However, the dwc3 driver must not submit TRBs more than the pool it has created for. This limit wasn't respected when SG was used resulting in submitting more than the max TRBs, eventually leading to non-transfer of the TRBs submitted over the max limit. Root cause: When SG is used, there are two loops iterating to prepare TRBs: - Outer loop over the request_list - Inner loop over the SG list The code was missing break to get out of the outer loop. Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists) Signed-off-by: Amit Virdi <amit.virdi@xxxxxx> Signed-off-by: Felipe Balbi <balbi@xxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/usb/dwc3/gadget.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -925,6 +925,9 @@ static void dwc3_prepare_trbs(struct dwc if (last_one) break; } + + if (last_one) + break; } else { dma = req->request.dma; length = req->request.length; Patches currently in stable-queue which might be from amit.virdi@xxxxxx are queue-3.10/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch queue-3.10/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html