projects
/
firefly-linux-kernel-4.4.55.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
usb: gadget: udc: atmel: fix possible oops when unloading module
[firefly-linux-kernel-4.4.55.git]
/
drivers
/
usb
/
gadget
/
udc
/
atmel_usba_udc.c
diff --git
a/drivers/usb/gadget/udc/atmel_usba_udc.c
b/drivers/usb/gadget/udc/atmel_usba_udc.c
index ce882371786b184d7b02f4a451d6c8c1b7a80efa..9f93bed42052cb5c910d5f34218287e58a558c6b 100644
(file)
--- a/
drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/
drivers/usb/gadget/udc/atmel_usba_udc.c
@@
-716,10
+716,10
@@
static int queue_dma(struct usba_udc *udc, struct usba_ep *ep,
req->using_dma = 1;
req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
| USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
req->using_dma = 1;
req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
| USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
- | USBA_DMA_END_
TR_EN | USBA_DMA_END_TR_IE
;
+ | USBA_DMA_END_
BUF_EN
;
- if (ep->is_in)
- req->ctrl |= USBA_DMA_END_
BUF_EN
;
+ if (
!
ep->is_in)
+ req->ctrl |= USBA_DMA_END_
TR_EN | USBA_DMA_END_TR_IE
;
/*
* Add this request to the queue and submit for DMA if
/*
* Add this request to the queue and submit for DMA if
@@
-828,7
+828,7
@@
static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
{
struct usba_ep *ep = to_usba_ep(_ep);
struct usba_udc *udc = ep->udc;
{
struct usba_ep *ep = to_usba_ep(_ep);
struct usba_udc *udc = ep->udc;
- struct usba_request *req
= to_usba_req(_req)
;
+ struct usba_request *req;
unsigned long flags;
u32 status;
unsigned long flags;
u32 status;
@@
-837,6
+837,16
@@
static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
spin_lock_irqsave(&udc->lock, flags);
spin_lock_irqsave(&udc->lock, flags);
+ list_for_each_entry(req, &ep->queue, queue) {
+ if (&req->req == _req)
+ break;
+ }
+
+ if (&req->req != _req) {
+ spin_unlock_irqrestore(&udc->lock, flags);
+ return -EINVAL;
+ }
+
if (req->using_dma) {
/*
* If this request is currently being transferred,
if (req->using_dma) {
/*
* If this request is currently being transferred,
@@
-1563,7
+1573,6
@@
static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep)
if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
receive_data(ep);
if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
receive_data(ep);
- usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
}
}
}
}