2 files changed, 16 insertions, 6 deletions

diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index ce882371786b..9f93bed42052 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -716,10 +716,10 @@ static int queue_dma(struct usba_udc *udc, struct usba_ep *ep,
         req->using_dma = 1;
         req->ctrl = USBA_BF(DMA_BUF_LEN, req->req.length)
                         | USBA_DMA_CH_EN | USBA_DMA_END_BUF_IE
-                        | USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
+                        | USBA_DMA_END_BUF_EN;
 
-        if (ep->is_in)
-                req->ctrl |= USBA_DMA_END_BUF_EN;
+        if (!ep->is_in)
+                req->ctrl |= USBA_DMA_END_TR_EN | USBA_DMA_END_TR_IE;
 
         /*
          * Add this request to the queue and submit for DMA if
@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 {
         struct usba_ep *ep = to_usba_ep(_ep);
         struct usba_udc *udc = ep->udc;
-        struct usba_request *req = to_usba_req(_req);
+        struct usba_request *req;
         unsigned long flags;
         u32 status;
 
@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 
         spin_lock_irqsave(&udc->lock, flags);
 
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+
+        if (&req->req != _req) {
+                spin_unlock_irqrestore(&udc->lock, flags);
+                return -EINVAL;
+        }
+
         if (req->using_dma) {
                 /*
                  * If this request is currently being transferred,
@@ -1563,7 +1573,6 @@ static void usba_ep_irq(struct usba_udc *udc, struct usba_ep *ep)
         if ((epstatus & epctrl) & USBA_RX_BK_RDY) {
                 DBG(DBG_BUS, "%s: RX data ready\n", ep->ep.name);
                 receive_data(ep);
-                usba_ep_writel(ep, CLR_STA, USBA_RX_BK_RDY);
         }
 }
 
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index ff67ceac77c4..d4fe8d769bd6 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -718,10 +718,11 @@ static int ep_queue(struct bdc_ep *ep, struct bdc_req *req)
         struct bdc *bdc;
         int ret = 0;
 
-        bdc = ep->bdc;
         if (!req || !ep || !ep->usb_ep.desc)
                 return -EINVAL;
 
+        bdc = ep->bdc;
+
         req->usb_req.actual = 0;
         req->usb_req.status = -EINPROGRESS;
         req->epnum = ep->ep_num;