openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Two bugs for Cadence USB3 gadget driver 

- TD_SIZE entry at descriptor is error for multiple-trb use case
 - Possible use uninitialized variables
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEDaZUZmFxRG/wNThrSFkpgVDWcbsFAl+yOtsACgkQSFkpgVDW
 cbvw6gf/dwumXsEWblgLn7pn+ruyJOlwwvjVcUB90ty19wzBmaUa5hiloa/x1IjJ
 XbW5nzu4otcB3OO23ChID9G8nan7Wryz9SGmkTa1CV5Y6dJUMsyCxOH3wZfEVVfH
 oqzNQ94oFZhrOO2dCfRH8XXRva79EatNTJGToyFkFMEX+oFjnRug7h+vtaoKBaUT
 reNCzxe91CgIMasdD7XKhlT6EuckW4h6L4V/Ecg9asiBAcx7GqM7YqGMYGPu4A0i
 j+voMfGdMROztGD9/XBIp8j3aGJQD2XmRtMC0pXfsEGEMA7M0JhaewIjCBO/5twX
 8J5nwMeWgo3UbMEBy0+iSi5uj0XHbQ==
 =NwwZ
 -----END PGP SIGNATURE-----

Merge tag 'usb-fixes-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus

Peter writes:

Two bugs for Cadence USB3 gadget driver
- TD_SIZE entry at descriptor is error for multiple-trb use case
- Possible use uninitialized variables

* tag 'usb-fixes-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb:
  usb: cdns3: gadget: calculate TD_SIZE based on TD
  usb: cdns3: gadget: initialize link_trb as NULL
This commit is contained in:
Greg Kroah-Hartman 2020-11-16 09:56:35 +01:00
parent 09162bc32c 40252dd7cf
commit af8f9e8611
1 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/usb/cdns3/gadget.c
View File

@ -1114,7 +1114,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
struct cdns3_request *priv_req;
struct cdns3_trb *trb;
struct cdns3_trb *link_trb;
struct cdns3_trb *link_trb = NULL;
dma_addr_t trb_dma;
u32 togle_pcs = 1;
int sg_iter = 0;
@ -1193,10 +1193,20 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
/* set incorrect Cycle Bit for first trb*/
control = priv_ep->pcs ? 0 : TRB_CYCLE;
trb->length = 0;
if (priv_dev->dev_ver >= DEV_VER_V2) {
u16 td_size;
td_size = DIV_ROUND_UP(request->length,
priv_ep->endpoint.maxpacket);
if (priv_dev->gadget.speed == USB_SPEED_SUPER)
trb->length = TRB_TDL_SS_SIZE(td_size);
else
control |= TRB_TDL_HS_SIZE(td_size);
}
do {
u32 length;
u16 td_size = 0;
/* fill TRB */
control |= TRB_TYPE(TRB_NORMAL);
@ -1208,20 +1218,12 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
length = request->length;
}
if (likely(priv_dev->dev_ver >= DEV_VER_V2))
td_size = DIV_ROUND_UP(length,
priv_ep->endpoint.maxpacket);
else if (priv_ep->flags & EP_TDLCHK_EN)
if (priv_ep->flags & EP_TDLCHK_EN)
total_tdl += DIV_ROUND_UP(length,
priv_ep->endpoint.maxpacket);
trb->length = cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |
trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |
TRB_LEN(length));
if (priv_dev->gadget.speed == USB_SPEED_SUPER)
trb->length |= cpu_to_le32(TRB_TDL_SS_SIZE(td_size));
else
control |= TRB_TDL_HS_SIZE(td_size);
pcs = priv_ep->pcs ? TRB_CYCLE : 0;
/*