gadgetfs: Fixed bug in ep_aio_read_retry. (50f97a1f) · Commits · 戴 / test

I don't think the current code works with multiple iovecs. The original would just copy the first part of priv->buf over and over into multiple iovecs. Signed-off-by:

Sarah Bailey <saharabeara@gmail.com> Signed-off-by:

David Brownell <dbrownell@users.sourceforge.net> Signed-off-by:

Greg Kroah-Hartman <gregkh@suse.de>

drivers/usb/gadget/inode.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -553,6 +553,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
		{
		struct kiocb_priv *priv = iocb->private;
		ssize_t len, total;
		void *to_copy;
		int i;

		/* we "retry" to get the right mm context for this: */
		@@ -560,10 +561,11 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
		/* copy stuff into user buffers */
		total = priv->actual;
		len = 0;
		to_copy = priv->buf;
		for (i=0; i < priv->nr_segs; i++) {
		ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);

		if (copy_to_user(priv->iv[i].iov_base, priv->buf, this)) {
		if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
		if (len == 0)
		len = -EFAULT;
		break;
		@@ -571,6 +573,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)

		total -= this;
		len += this;
		to_copy += this;
		if (total == 0)
		break;
		}

Admin message