diff options
| author | Thinh Nguyen <Thinh.Nguyen@synopsys.com> | 2024-11-14 01:02:12 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-05 14:03:01 +0100 |
| commit | 2f6c3acece2b87bfa11a1e5fc4018488d9139d56 (patch) | |
| tree | 2491fe7d81c391efe0468491ac10dfdaf963c783 /lib/debugobjects.c | |
| parent | de7c079c8cca04ba8b1775683ee75150916dd741 (diff) | |
| download | linux-2f6c3acece2b87bfa11a1e5fc4018488d9139d56.tar.gz linux-2f6c3acece2b87bfa11a1e5fc4018488d9139d56.tar.bz2 linux-2f6c3acece2b87bfa11a1e5fc4018488d9139d56.zip | |
usb: dwc3: gadget: Fix checking for number of TRBs left
commit 02a6982b0ccfcdc39e20016f5fc9a1b7826a6ee7 upstream.
The check whether the TRB ring is full or empty in dwc3_calc_trbs_left()
is insufficient. It assumes there are active TRBs if there's any request
in the started_list. However, that's not the case for requests with a
large SG list.
That is, if we have a single usb request that requires more TRBs than
the total TRBs in the TRB ring, the queued TRBs will be available when
all the TRBs in the ring are completed. But the request is only
partially completed and remains in the started_list. With the current
logic, the TRB ring is empty, but dwc3_calc_trbs_left() returns 0.
Fix this by additionally checking for the request->num_trbs for active
TRB count.
Cc: stable@vger.kernel.org
Fixes: 51f1954ad853 ("usb: dwc3: gadget: Fix dwc3_calc_trbs_left()")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/708dc62b56b77da1f704cc2ae9b6ddb1f2dbef1f.1731545781.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions