Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa28b030 authored by Hemant Kumar's avatar Hemant Kumar
Browse files

usb: dwc3: Fix bug in ep disable operation 



__dwc3_gadget_ep_disable API doing memset 0 with size
set to DWC3_TRB_NUM. Number of TRBs allocated for gsi
endpoints are less than DWC3_TRB_NUM. This results in
to memory corruption. Fix this bug by introducing
num_trbs member in dwc3_ep structure to save number of
trbs allocated in a dma pool upon dma pool creation.
Ep disable operation will use num_trbs of a dwc3_ep to
perform memset 0.

Change-Id: I94b5865ca22b4e1fde0d2cd8dcb218906327a916
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent 400520a6

drivers/usb/dwc3/core.h

+2 −0
Original line number Diff line number Diff line
@@ -513,6 +513,7 @@ struct dwc3_ep_events { 
 * @trb_dma_pool: dma pool used to get aligned trb memory pool

 * @trb_pool: array of transaction buffers

 * @trb_pool_dma: dma address of @trb_pool

 * @num_trbs: num of trbs in the trb dma pool

 * @free_slot: next slot which is going to be used

 * @busy_slot: first slot which is owned by HW

 * @desc: usb_endpoint_descriptor pointer
@@ -539,6 +540,7 @@ struct dwc3_ep { 
	struct dma_pool		*trb_dma_pool;

	struct dwc3_trb		*trb_pool;

	dma_addr_t		trb_pool_dma;

	u32			num_trbs;

	u32			free_slot;

	u32			busy_slot;

	const struct usb_ss_ep_comp_descriptor *comp_desc;

drivers/usb/dwc3/dwc3-msm.c

+2 −0
Original line number Diff line number Diff line
@@ -969,6 +969,8 @@ static int gsi_prepare_trbs(struct usb_ep *ep, struct usb_gsi_request *req) 
		return -ENOMEM;

	}



	dep->num_trbs = num_trbs;



	dep->trb_pool = dma_pool_alloc(dep->trb_dma_pool,

					   GFP_KERNEL, &dep->trb_pool_dma);

	if (!dep->trb_pool) {

drivers/usb/dwc3/gadget.c

+4 −2
Original line number Diff line number Diff line
@@ -390,18 +390,20 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep, 
static int dwc3_alloc_trb_pool(struct dwc3_ep *dep)

{

	struct dwc3		*dwc = dep->dwc;

	u32			num_trbs = DWC3_TRB_NUM;



	if (dep->trb_pool)

		return 0;



	dep->trb_pool = dma_zalloc_coherent(dwc->dev,

			sizeof(struct dwc3_trb) * DWC3_TRB_NUM,

			sizeof(struct dwc3_trb) * num_trbs,

			&dep->trb_pool_dma, GFP_KERNEL);

	if (!dep->trb_pool) {

		dev_err(dep->dwc->dev, "failed to allocate trb pool for %s\n",

				dep->name);

		return -ENOMEM;

	}

	dep->num_trbs = num_trbs;



	return 0;

}
@@ -688,7 +690,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) 
	 */

	if (dep->number > 1) {

		memset(&dep->trb_pool[0], 0,

			sizeof(struct dwc3_trb) * DWC3_TRB_NUM);

			sizeof(struct dwc3_trb) * dep->num_trbs);

		dbg_event(dep->number, "Clr_TRB", 0);

	}