Merge tag 'usb-fixes-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git...

Peter writes:

Two bugs for Cadence USB3 gadget driver
- TD_SIZE entry at descriptor is error for multiple-trb use case
- Possible use uninitialized variables

* tag 'usb-fixes-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb:
  usb: cdns3: gadget: calculate TD_SIZE based on TD
  usb: cdns3: gadget: initialize link_trb as NULL

diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
index 66c1e67..365f30f 100644 (file)
--- a/drivers/usb/cdns3/gadget.c
+++ b/drivers/usb/cdns3/gadget.c
@@ -1114,7 +1114,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
        struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
        struct cdns3_request *priv_req;
        struct cdns3_trb *trb;
-       struct cdns3_trb *link_trb;
+       struct cdns3_trb *link_trb = NULL;
        dma_addr_t trb_dma;
        u32 togle_pcs = 1;
        int sg_iter = 0;
@@ -1193,10 +1193,20 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
 
        /* set incorrect Cycle Bit for first trb*/
        control = priv_ep->pcs ? 0 : TRB_CYCLE;
+       trb->length = 0;
+       if (priv_dev->dev_ver >= DEV_VER_V2) {
+               u16 td_size;
+
+               td_size = DIV_ROUND_UP(request->length,
+                                      priv_ep->endpoint.maxpacket);
+               if (priv_dev->gadget.speed == USB_SPEED_SUPER)
+                       trb->length = TRB_TDL_SS_SIZE(td_size);
+               else
+                       control |= TRB_TDL_HS_SIZE(td_size);
+       }
 
        do {
                u32 length;
-               u16 td_size = 0;
 
                /* fill TRB */
                control |= TRB_TYPE(TRB_NORMAL);
@@ -1208,20 +1218,12 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
                        length = request->length;
                }
 
-               if (likely(priv_dev->dev_ver >= DEV_VER_V2))
-                       td_size = DIV_ROUND_UP(length,
-                                              priv_ep->endpoint.maxpacket);
-               else if (priv_ep->flags & EP_TDLCHK_EN)
+               if (priv_ep->flags & EP_TDLCHK_EN)
                        total_tdl += DIV_ROUND_UP(length,
                                               priv_ep->endpoint.maxpacket);
 
-               trb->length = cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |
+               trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |
                                        TRB_LEN(length));
-               if (priv_dev->gadget.speed == USB_SPEED_SUPER)
-                       trb->length |= cpu_to_le32(TRB_TDL_SS_SIZE(td_size));
-               else
-                       control |= TRB_TDL_HS_SIZE(td_size);
-
                pcs = priv_ep->pcs ? TRB_CYCLE : 0;
 
                /*