diff options
| author | Jack Pham <jackp@codeaurora.org> | 2017-06-29 00:53:31 -0700 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2017-07-17 11:01:27 +0300 |
| commit | 4a71fcb8ac5f94c07bf47a43b13258a52e4fe3ad (patch) | |
| tree | b270a4868052eb0bd271a56001afb09aad3ff234 /drivers/usb/dwc3/gadget.c | |
| parent | a9ef5c47d065e3c8a6eb0e5911e95809811e6c6b (diff) | |
usb: dwc3: gadget: only unmap requests from DMA if mapped
A recent optimization was made so that a request put on the
pending_list wouldn't get mapped for DMA until just before
preparing a TRB for it. However, this poses a problem in case
the request is dequeued or the endpoint is disabled before the
mapping is done as that would lead to dwc3_gadget_giveback()
unconditionally calling usb_gadget_unmap_request_for_dev() with
an invalid request->dma handle. Depending on the platform's DMA
implementation the unmap operation could result in a panic.
Since we know a successful mapping is a prerequisite for getting
a TRB, the unmap can be conditionally called only when req->trb
is non-NULL.
Fixes: cdb55b39fab8 ("usb: dwc3: gadget: lazily map requests for DMA")
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb/dwc3/gadget.c')
| -rw-r--r-- | drivers/usb/dwc3/gadget.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 9e41605a276b..6b299c7b7656 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -191,14 +191,16 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, req->started = false; list_del(&req->list); - req->trb = NULL; req->remaining = 0; if (req->request.status == -EINPROGRESS) req->request.status = status; - usb_gadget_unmap_request_by_dev(dwc->sysdev, - &req->request, req->direction); + if (req->trb) + usb_gadget_unmap_request_by_dev(dwc->sysdev, + &req->request, req->direction); + + req->trb = NULL; trace_dwc3_gadget_giveback(req); |