From: Jack Pham Date: Thu, 29 Jun 2017 07:53:31 +0000 (-0700) Subject: usb: dwc3: gadget: only unmap requests from DMA if mapped X-Git-Tag: android-x86-8.1-r1~3030^2~6^2~10 X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=4a71fcb8ac5f94c07bf47a43b13258a52e4fe3ad;p=android-x86%2Fkernel.git usb: dwc3: gadget: only unmap requests from DMA if mapped A recent optimization was made so that a request put on the pending_list wouldn't get mapped for DMA until just before preparing a TRB for it. However, this poses a problem in case the request is dequeued or the endpoint is disabled before the mapping is done as that would lead to dwc3_gadget_giveback() unconditionally calling usb_gadget_unmap_request_for_dev() with an invalid request->dma handle. Depending on the platform's DMA implementation the unmap operation could result in a panic. Since we know a successful mapping is a prerequisite for getting a TRB, the unmap can be conditionally called only when req->trb is non-NULL. Fixes: cdb55b39fab8 ("usb: dwc3: gadget: lazily map requests for DMA") Signed-off-by: Jack Pham Signed-off-by: Felipe Balbi --- diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 9e41605a276b..6b299c7b7656 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -191,14 +191,16 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, req->started = false; list_del(&req->list); - req->trb = NULL; req->remaining = 0; if (req->request.status == -EINPROGRESS) req->request.status = status; - usb_gadget_unmap_request_by_dev(dwc->sysdev, - &req->request, req->direction); + if (req->trb) + usb_gadget_unmap_request_by_dev(dwc->sysdev, + &req->request, req->direction); + + req->trb = NULL; trace_dwc3_gadget_giveback(req);