Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a9ce1df authored by Igor Kotrasinski's avatar Igor Kotrasinski Committed by Felipe Balbi
Browse files

usb: gadget: dummy_hcd: in transfer(), return data sent, not limit 



dummy_timer uses transfer() to update transfer limit. However,
limit passed to dummy_timer changes depending on transfer type,
so the actual limit is overwritten.

This can cause unpredictably slow / fast bulk transfers when
coupled with control / interrupt transfers.

Fix by returning actual amount of data sent in transfer() and
substracting from total.

Signed-off-by: default avatarIgor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent e42bd6a5

drivers/usb/gadget/udc/dummy_hcd.c

+4 −2
Original line number Diff line number Diff line
@@ -1348,6 +1348,7 @@ static int transfer(struct dummy_hcd *dum_hcd, struct urb *urb, 
{

	struct dummy		*dum = dum_hcd->dum;

	struct dummy_request	*req;

	int			sent = 0;



top:

	/* if there's no request queued, the device is NAKing; return */
@@ -1402,6 +1403,7 @@ static int transfer(struct dummy_hcd *dum_hcd, struct urb *urb, 
				req->req.status = len;

			} else {

				limit -= len;

				sent += len;

				urb->actual_length += len;

				req->req.actual += len;

			}
@@ -1472,7 +1474,7 @@ static int transfer(struct dummy_hcd *dum_hcd, struct urb *urb, 
		if (rescan)

			goto top;

	}

	return limit;

	return sent;

}



static int periodic_bytes(struct dummy *dum, struct dummy_ep *ep)
@@ -1902,7 +1904,7 @@ static void dummy_timer(unsigned long _dum_hcd) 
		default:

treat_control_like_bulk:

			ep->last_io = jiffies;

			total = transfer(dum_hcd, urb, ep, limit, &status);

			total -= transfer(dum_hcd, urb, ep, limit, &status);

			break;

		}