Commit 4a71fcb8 authored by Jack Pham's avatar Jack Pham Committed by Felipe Balbi

usb: dwc3: gadget: only unmap requests from DMA if mapped

A recent optimization was made so that a request put on the
pending_list wouldn't get mapped for DMA until just before
preparing a TRB for it. However, this poses a problem in case
the request is dequeued or the endpoint is disabled before the
mapping is done as that would lead to dwc3_gadget_giveback()
unconditionally calling usb_gadget_unmap_request_for_dev() with
an invalid request->dma handle. Depending on the platform's DMA
implementation the unmap operation could result in a panic.

Since we know a successful mapping is a prerequisite for getting
a TRB, the unmap can be conditionally called only when req->trb
is non-NULL.

Fixes: cdb55b39 ("usb: dwc3: gadget: lazily map requests for DMA")
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent a9ef5c47
...@@ -191,14 +191,16 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, ...@@ -191,14 +191,16 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
req->started = false; req->started = false;
list_del(&req->list); list_del(&req->list);
req->trb = NULL;
req->remaining = 0; req->remaining = 0;
if (req->request.status == -EINPROGRESS) if (req->request.status == -EINPROGRESS)
req->request.status = status; req->request.status = status;
usb_gadget_unmap_request_by_dev(dwc->sysdev, if (req->trb)
&req->request, req->direction); usb_gadget_unmap_request_by_dev(dwc->sysdev,
&req->request, req->direction);
req->trb = NULL;
trace_dwc3_gadget_giveback(req); trace_dwc3_gadget_giveback(req);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment