usb: dwc3: gadget: Wrap around when skip TRBs

When skipping TRBs, we need to account for wrapping around the ring
buffer and not modifying some invalid TRBs. Without this fix, dwc3 won't
be able to check for available TRBs.

Cc: stable <stable@vger.kernel.org>
Fixes: 7746a8dfb3f9 ("usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs()")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index b032e62fff0f554410bf4c0d32aa8b1aa32b1c6f..4d3c79d90a6e4a420cc079dc62e2a25a49f1c705 100644 (file)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1521,7 +1521,7 @@ static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *r
        for (i = 0; i < req->num_trbs; i++) {
                struct dwc3_trb *trb;
 
-               trb = req->trb + i;
+               trb = &dep->trb_pool[dep->trb_dequeue];
                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                dwc3_ep_inc_deq(dep);
        }