Commit 4a71fcb8 authored Jun 29, 2017 by Jack Pham Committed by Felipe Balbi Jul 17, 2017

usb: dwc3: gadget: only unmap requests from DMA if mapped



A recent optimization was made so that a request put on the
pending_list wouldn't get mapped for DMA until just before
preparing a TRB for it. However, this poses a problem in case
the request is dequeued or the endpoint is disabled before the
mapping is done as that would lead to dwc3_gadget_giveback()
unconditionally calling usb_gadget_unmap_request_for_dev() with
an invalid request->dma handle. Depending on the platform's DMA
implementation the unmap operation could result in a panic.

Since we know a successful mapping is a prerequisite for getting
a TRB, the unmap can be conditionally called only when req->trb
is non-NULL.

Fixes: cdb55b39 ("usb: dwc3: gadget: lazily map requests for DMA")
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

parent a9ef5c47

drivers/usb/dwc3/gadget.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -191,15 +191,17 @@ void dwc3_gadget_giveback(struct dwc3_ep dep, struct dwc3_request req,

		req->started = false;
		list_del(&req->list);
		req->trb = NULL;
		req->remaining = 0;

		if (req->request.status == -EINPROGRESS)
		req->request.status = status;

		if (req->trb)
		usb_gadget_unmap_request_by_dev(dwc->sysdev,
		&req->request, req->direction);

		req->trb = NULL;

		trace_dwc3_gadget_giveback(req);

		spin_unlock(&dwc->lock);