USB: xhci: Set -EREMOTEIO when xHC gives bad transfer length.

commit 2f697f6cbff155b3ce4053a50cdf00b5be4dda11 upstream.

The xHCI hardware reports the number of bytes untransferred for a given
transfer buffer.  If the hardware reports a bytes untransferred value
greater than the submitted buffer size, we want to play it safe and say no
data was transferred.  If the driver considers a short packet to be an
error, remember to set -EREMOTEIO.

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d264f9a6c559cd20a2b96d25504cc4dfa1c9df0e..aac379e1c88373a6f37af30798e431f1502d127c 100644 (file)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1104,6 +1104,11 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                                        "of %d bytes left\n",
                                                        TRB_LEN(event->transfer_len));
                                        td->urb->actual_length = 0;
+                                       if (td->urb->transfer_flags &
+                                                       URB_SHORT_NOT_OK)
+                                               status = -EREMOTEIO;
+                                       else
+                                               status = 0;
                                }
                                /* Don't overwrite a previously set error code */
                                if (status == -EINPROGRESS) {
@@ -1187,6 +1192,10 @@ td_cleanup:
                                        urb->transfer_buffer_length,
                                        urb->actual_length);
                        urb->actual_length = 0;
+                       if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                               status = -EREMOTEIO;
+                       else
+                               status = 0;
                }
                list_del(&td->td_list);
                /* Was this TD slated to be cancelled but completed anyway? */