USB: fix ep_config to return correct value

This patch fixes ep_config to return correct value. Without patch
ep_config returns submitted lenght minus 4 on succes. With this
patch applied, whole submitted lenght is returned.

ep_config parses submitted data and if buffer starts with (int) 1
it is parsed, otherwise error is reported. Problem is that ep_config
returns size of buffer minus 4 on success. I think that size of buffer
should be returned instead, because there were no problems and
all data were processed.

Signed-off-by: Milan Svoboda <msvoboda@ra.rockwell.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index da85732fa99..72c88aa94d5 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -741,7 +741,7 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         struct ep_data          *data = fd->private_data;
         struct usb_ep           *ep;
         u32                     tag;
-        int                     value;
+        int                     value, length = len;
 
         if ((value = down_interruptible (&data->lock)) < 0)
                 return value;
@@ -792,7 +792,6 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         goto fail0;
                 }
         }
-        value = len;
 
         spin_lock_irq (&data->dev->lock);
         if (data->dev->state == STATE_DEV_UNBOUND) {
@@ -822,8 +821,10 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                                 data->name);
                 data->state = STATE_EP_DEFER_ENABLE;
         }
-        if (value == 0)
+        if (value == 0) {
                 fd->f_op = &ep_io_operations;
+                value = length;
+        }
 gone:
         spin_unlock_irq (&data->dev->lock);
         if (value < 0) {