usb: dwc3: gadget: increment request->actual once

When using SG lists, we would end up setting
request->actual to:

	num_mapped_sgs * (request->length - count)

Let's fix that up by incrementing request->actual
only once.

Cc: <stable@vger.kernel.org>
Reported-by: Brian E Rogers <brian.e.rogers@intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

1 files changed, 11 insertions, 8 deletions

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8f8c2157910e..863c306ebb69 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2013,14 +2013,6 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                         s_pkt = 1;
         }
 
-        /*
-         * We assume here we will always receive the entire data block
-         * which we should receive. Meaning, if we program RX to
-         * receive 4K but we receive only 2K, we assume that's all we
-         * should receive and we simply bounce the request back to the
-         * gadget driver for further processing.
-         */
-        req->request.actual += req->request.length - count;
         if (s_pkt)
                 return 1;
         if ((event->status & DEPEVT_STATUS_LST) &&
@@ -2040,6 +2032,7 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
         struct dwc3_trb         *trb;
         unsigned int            slot;
         unsigned int            i;
+        int                     count = 0;
         int                     ret;
 
         do {
@@ -2054,6 +2047,8 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
                                 slot++;
                         slot %= DWC3_TRB_NUM;
                         trb = &dep->trb_pool[slot];
+                        count += trb->size & DWC3_TRB_SIZE_MASK;
+
 
                         ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
                                         event, status);
@@ -2061,6 +2056,14 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
                                 break;
                 } while (++i < req->request.num_mapped_sgs);
 
+                /*
+                 * We assume here we will always receive the entire data block
+                 * which we should receive. Meaning, if we program RX to
+                 * receive 4K but we receive only 2K, we assume that's all we
+                 * should receive and we simply bounce the request back to the
+                 * gadget driver for further processing.
+                 */
+                req->request.actual += req->request.length - count;
                 dwc3_gadget_giveback(dep, req, status);
 
                 if (ret)