Hi Greg,

It is backport to 5.4 stable version. Please apply this patch.

Thanks, Pawel

commit b3fa25de31fb7e9afebe9599b8ff32eda13d7c94 upstream.

Path fixes bug which occurs during resetting endpoint in __cdns3_gadget_ep_clear_halt function. During resetting endpoint controller will change HW/DMA owned TRB. It set Abort flag in trb->control and will change trb->length field. If driver want to use the aborted trb it must update the changed field in TRB.

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") cc: stable@vger.kernel.org Acked-by: Peter Chen peter.chen@kernel.org Signed-off-by: Pawel Laszczak pawell@cadence.com

---

drivers/usb/cdns3/gadget.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c index 296f2ee1b680..4990f048d30f 100644 --- a/drivers/usb/cdns3/gadget.c +++ b/drivers/usb/cdns3/gadget.c @@ -2166,6 +2166,7 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) struct usb_request *request; struct cdns3_request *priv_req; struct cdns3_trb *trb = NULL;

• struct cdns3_trb trb_tmp; int ret; int val;

@@ -2175,8 +2176,10 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) if (request) { priv_req = to_cdns3_request(request); trb = priv_req->trb;

• if (trb)
  

• if (trb) {
  

• 	trb_tmp = *trb;
  trb->control = trb->control ^ TRB_CYCLE;
  

• }
  

  }

  writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd);

@@ -2191,7 +2194,8 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep)

if (request) { if (trb)

• 	trb->control = trb->control ^ TRB_CYCLE;
  

• 	*trb = trb_tmp;
  

• cdns3_rearm_transfer(priv_ep, 1); }

-- 2.25.1