usb: renesas_usbhs: getting residue from callback_result
authorYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Thu, 18 Jun 2020 12:11:17 +0000 (21:11 +0900)
committerSasha Levin <sashal@kernel.org>
Tue, 30 Jun 2020 19:37:00 +0000 (15:37 -0400)
commitf9dc5e708ab8a6e0593d9064308939d8a34e3f91
tree63238626a9fbe1c178ffe6955a6ada81268127ff
parent56ee0ed97df5cace405e86a9632ad648b5b8f00b
usb: renesas_usbhs: getting residue from callback_result

[ Upstream commit ea0efd687b01355cd799c8643d0c636ba4859ffc ]

This driver assumed that dmaengine_tx_status() could return
the residue even if the transfer was completed. However,
this was not correct usage [1] and this caused to break getting
the residue after the commit 24461d9792c2 ("dmaengine:
virt-dma: Fix access after free in vchan_complete()") actually.
So, this is possible to get wrong received size if the usb
controller gets a short packet. For example, g_zero driver
causes "bad OUT byte" errors.

The usb-dmac driver will support the callback_result, so this
driver can use it to get residue correctly. Note that even if
the usb-dmac driver has not supported the callback_result yet,
this patch doesn't cause any side-effects.

[1]
https://lore.kernel.org/dmaengine/20200616165550.GP2324254@vkoul-mobl/

Reported-by: Hien Dang <hien.dang.eb@renesas.com>
Fixes: 24461d9792c2 ("dmaengine: virt-dma: Fix access after free in vchan_complete()")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1592482277-19563-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/usb/renesas_usbhs/fifo.c
drivers/usb/renesas_usbhs/fifo.h