---

yaml
---
r: 264991
b: refs/heads/master
c: 55f3fba
h: refs/heads/master
i:
  264989: 062e4f6
  264987: 0d6bac1
  264983: e1f20cd
  264975: f76a03e
  264959: 5257f87
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d742220b357769fa0a764d238373b8667116cf64
+refs/heads/master: 55f3fba6c822f05b02f06070efaadf0300b5f9f1

trunk/drivers/usb/dwc3/core.h

@@ -529,6 +529,7 @@ static inline void dwc3_trb_to_nat(struct dwc3_trb_hw *hw, struct dwc3_trb *nat)
  * @three_stage_setup: set if we perform a three phase setup
  * @ep0_status_pending: ep0 status response without a req is pending
  * @ep0_bounced: true when we used bounce buffer
+ * @ep0_expect_in: true when we expect a DATA IN transfer
  * @ep0_next_event: hold the next expected event
  * @ep0state: state of endpoint zero
  * @link_state: link state
@@ -575,6 +576,7 @@ struct dwc3 {
 	unsigned		three_stage_setup:1;
 	unsigned		ep0_status_pending:1;
 	unsigned		ep0_bounced:1;
+	unsigned		ep0_expect_in:1;
 
 	enum dwc3_ep0_next	ep0_next_event;
 	enum dwc3_ep0_state	ep0state;

trunk/drivers/usb/dwc3/ep0.c

@@ -545,6 +545,8 @@ static void dwc3_ep0_inspect_setup(struct dwc3 *dwc,
 		dwc->ep0_next_event = DWC3_EP0_NRDY_DATA;
 	}
 
+	dwc->ep0_expect_in = !!(ctrl->bRequestType & USB_DIR_IN);
+
 	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD)
 		ret = dwc3_ep0_std_request(dwc, ctrl);
 	else
@@ -758,6 +760,20 @@ static void dwc3_ep0_xfernotready(struct dwc3 *dwc,
 			return;
 		}
 
+		/*
+		 * One of the possible error cases is when Host _does_
+		 * request for Data Phase, but it does so on the wrong
+		 * direction.
+		 *
+		 * Here, we already know ep0_next_event is DATA (see above),
+		 * so we only need to check for direction.
+		 */
+		if (dwc->ep0_expect_in != event->endpoint_number) {
+			dev_vdbg(dwc->dev, "Wrong direction for Data phase\n");
+			dwc3_ep0_stall_and_restart(dwc);
+			return;
+		}
+
 		dwc3_ep0_do_control_data(dwc, event);
 		break;