usb: isp1760: fix qtd fill length

[ Upstream commit cbfa3effdf5c2d411c9ce9820f3d33d77bc4697d ]

When trying to send bulks bigger than the biggest block size
we need to split them over several qtd. Fix this limiting the
maximum qtd size to largest block size.

Reported-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Link: https://lore.kernel.org/r/20210827131154.4151862-3-rui.silva@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/usb/isp1760/isp1760-hcd.c b/drivers/usb/isp1760/isp1760-hcd.c
index ffb3a0c8c909ec9f4dbd4770fb6e24a30a756093..d2d19548241e39eb06f0577072a14947a630b7a2 100644 (file)
--- a/drivers/usb/isp1760/isp1760-hcd.c
+++ b/drivers/usb/isp1760/isp1760-hcd.c
@@ -1826,9 +1826,11 @@ static void packetize_urb(struct usb_hcd *hcd,
                        goto cleanup;
 
                if (len > mem->blocks_size[ISP176x_BLOCK_NUM - 1])
-                       len = mem->blocks_size[ISP176x_BLOCK_NUM - 1];
+                       this_qtd_len = mem->blocks_size[ISP176x_BLOCK_NUM - 1];
+               else
+                       this_qtd_len = len;
 
-               this_qtd_len = qtd_fill(qtd, buf, len);
+               this_qtd_len = qtd_fill(qtd, buf, this_qtd_len);
                list_add_tail(&qtd->qtd_list, head);
 
                len -= this_qtd_len;