Merge tag 'for-usb-next-2014-01-08' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-next

Sarah writes:

xhci: Urgent bug fixes for usb-next and 3.14.

Hi Greg,

Please queue these two patches to usb-next for 3.14.

An xHCI driver fix for USB ethernet devices that went into 3.13 and 3.12
stable is causing usb-storage to go into an infinite loop, and these two
patches fix the issue.  I would like these to get into 3.14-rc1 so we
can avoid any potential data corruption for users.

Sarah Sharp

3 files changed, 4 insertions, 4 deletions

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 09b2b551be72..a0b248c34526 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3000,7 +3000,7 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
                         if (num_trbs >= TRBS_PER_SEGMENT) {
                                 xhci_err(xhci, "Too many fragments %d, max %d\n",
                                                 num_trbs, TRBS_PER_SEGMENT - 1);
-                                return -ENOMEM;
+                                return -EINVAL;
                         }
 
                         nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f8ffc512faf1..ad364394885a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4730,8 +4730,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         struct device           *dev = hcd->self.controller;
         int                     retval;
 
-        /* Accept arbitrarily long scatter-gather lists */
-        hcd->self.sg_tablesize = ~0;
+        /* Limit the block layer scatter-gather lists to half a segment. */
+        hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
 
         /* support to build packet from discontinuous buffers */
         hcd->self.no_sg_constraint = 1;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 24344aab2107..f8416639bf31 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1279,7 +1279,7 @@ union xhci_trb {
  * since the command ring is 64-byte aligned.
  * It must also be greater than 16.
  */
-#define TRBS_PER_SEGMENT        64
+#define TRBS_PER_SEGMENT        256
 /* Allow two commands + a link TRB, along with any reserved command TRBs */
 #define MAX_RSVD_CMD_TRBS       (TRBS_PER_SEGMENT - 3)
 #define TRB_SEGMENT_SIZE        (TRBS_PER_SEGMENT*16)