usb: xhci: expand the scope of XHCI_VLI_SS_BULK_OUT_BUG

Further testing has revealed that any TRB with buffer length that is not
a multiple of wMaxPacket and not the last TRB in a TD can cause data
corruption.

Work around this by linearising any vulnerable Bulk OUT scatter-gather
URBs prior to URB submission. Normal XHCI TRB formation will split
buffers on 64K boundaries and align TRBs prior to a Link TRB to
wMaxPacket, so keep the residue TRB generation added with the first
iteration of the quirk which will guarantee the last TRB is the only TRB
with an odd buffer size.

Signed-off-by: Jonathan Bell <[email protected]>

Author: P33M

drivers/usb/host/xhci.c

@@ -1395,9 +1395,12 @@ static void xhci_unmap_temp_buf(struct usb_hcd *hcd, struct urb *urb)
 static int xhci_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
 				gfp_t mem_flags)
 {
+	unsigned int i, maxpacket;
+	struct scatterlist *sg;
 	struct xhci_hcd *xhci;
 
 	xhci = hcd_to_xhci(hcd);
+	maxpacket = usb_endpoint_maxp(&urb->ep->desc);
 
 	if (xhci_urb_suitable_for_idt(urb))
 		return 0;
@@ -1406,6 +1409,16 @@ static int xhci_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
 		if (xhci_urb_temp_buffer_required(hcd, urb))
 			return xhci_map_temp_buffer(hcd, urb);
 	}
+
+	if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG &&
+	    usb_endpoint_is_bulk_out(&urb->ep->desc) &&
+	    urb->dev->speed >= USB_SPEED_SUPER &&
+	    urb->transfer_buffer_length != 0) {
+		for_each_sg(urb->sg, sg, urb->num_sgs, i) {
+			if (sg->length % maxpacket)
+				return xhci_map_temp_buffer(hcd, urb);
+		}
+	}
 	return usb_hcd_map_urb_for_dma(hcd, urb, mem_flags);
 }
 
@@ -1419,7 +1432,8 @@ static void xhci_unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb)
 	if (urb->num_sgs && (urb->transfer_flags & URB_DMA_MAP_SINGLE))
 		unmap_temp_buf = true;
 
-	if ((xhci->quirks & XHCI_SG_TRB_CACHE_SIZE_QUIRK) && unmap_temp_buf)
+	if ((xhci->quirks & (XHCI_SG_TRB_CACHE_SIZE_QUIRK | XHCI_VLI_SS_BULK_OUT_BUG))
+	     && unmap_temp_buf)
 		xhci_unmap_temp_buf(hcd, urb);
 	else
 		usb_hcd_unmap_urb_for_dma(hcd, urb);