1 files changed, 16 insertions, 3 deletions

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6ce77b33da61..263dd2f309fb 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1434,10 +1434,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         struct async *as = NULL;
         struct usb_ctrlrequest *dr = NULL;
         unsigned int u, totlen, isofrmlen;
-        int i, ret, is_in, num_sgs = 0, ifnum = -1;
+        int i, ret, num_sgs = 0, ifnum = -1;
         int number_of_packets = 0;
         unsigned int stream_id = 0;
         void *buf;
+        bool is_in;
+        bool allow_short = false;
+        bool allow_zero = false;
         unsigned long mask =    USBDEVFS_URB_SHORT_NOT_OK |
                                 USBDEVFS_URB_BULK_CONTINUATION |
                                 USBDEVFS_URB_NO_FSBR |
@@ -1471,6 +1474,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         u = 0;
         switch (uurb->type) {
         case USBDEVFS_URB_TYPE_CONTROL:
+                if (is_in)
+                        allow_short = true;
                 if (!usb_endpoint_xfer_control(&ep->desc))
                         return -EINVAL;
                 /* min 8 byte setup packet */
@@ -1511,6 +1516,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                 break;
 
         case USBDEVFS_URB_TYPE_BULK:
+                if (!is_in)
+                        allow_zero = true;
+                else
+                        allow_short = true;
                 switch (usb_endpoint_type(&ep->desc)) {
                 case USB_ENDPOINT_XFER_CONTROL:
                 case USB_ENDPOINT_XFER_ISOC:
@@ -1531,6 +1540,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                 if (!usb_endpoint_xfer_int(&ep->desc))
                         return -EINVAL;
  interrupt_urb:
+                if (!is_in)
+                        allow_zero = true;
+                else
+                        allow_short = true;
                 break;
 
         case USBDEVFS_URB_TYPE_ISO:
@@ -1676,9 +1689,9 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
         if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
                 u |= URB_ISO_ASAP;
-        if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
+        if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
                 u |= URB_SHORT_NOT_OK;
-        if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+        if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
                 u |= URB_ZERO_PACKET;
         if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
                 u |= URB_NO_INTERRUPT;