Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70b8b076 authored by zhang sanshan's avatar zhang sanshan Committed by Jerry Zhang
Browse files

ANDROID: USB gadget: mtp: Fix hang in ioctl(MTP_RECEIVE_FILE) for WritePartialObject 



user space will hang at ioctl when copy file.
ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr);
length of read_req need rounded up to max packet size for usb_ep_queue,
Otherwise the read request will never complete.

Change-Id: Id8c6d7c44d1c16bb81dd77d3acc96ef2ab31f4c2
Signed-off-by: default avatarMike Lockwood <lockwood@google.com>
Signed-off-by: default avatarzhang sanshan <sanshan.zhang@nxp.com>
parent 9452b2c2

drivers/usb/gadget/function/f_mtp.c

+5 −3
Original line number Diff line number Diff line
@@ -825,7 +825,7 @@ static void receive_file_work(struct work_struct *data) 
	struct usb_request *read_req = NULL, *write_req = NULL;

	struct file *filp;

	loff_t offset;

	int64_t count;

	int64_t count, len;

	int ret, cur_buf = 0;

	int r = 0;
@@ -843,8 +843,10 @@ static void receive_file_work(struct work_struct *data) 
			read_req = dev->rx_req[cur_buf];

			cur_buf = (cur_buf + 1) % RX_REQ_MAX;



			read_req->length = (count > MTP_BULK_BUFFER_SIZE

					? MTP_BULK_BUFFER_SIZE : count);

			len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);

			if (len > MTP_BULK_BUFFER_SIZE)

				len = MTP_BULK_BUFFER_SIZE;

			read_req->length = len;

			dev->rx_done = 0;

			ret = usb_ep_queue(dev->ep_out, read_req, GFP_KERNEL);

			if (ret < 0) {