gadgetfs: Fixed bug in ep_aio_read_retry.

I don't think the current code works with multiple iovecs.
The original would just copy the first part of priv->buf
over and over into multiple iovecs.

Signed-off-by: Sarah Bailey <saharabeara@gmail.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 34296e79edcf..188c74a95216 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -553,6 +553,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
 {
         struct kiocb_priv       *priv = iocb->private;
         ssize_t                 len, total;
+        void                    *to_copy;
         int                     i;
 
         /* we "retry" to get the right mm context for this: */
@@ -560,10 +561,11 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
         /* copy stuff into user buffers */
         total = priv->actual;
         len = 0;
+        to_copy = priv->buf;
         for (i=0; i < priv->nr_segs; i++) {
                 ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
 
-                if (copy_to_user(priv->iv[i].iov_base, priv->buf, this)) {
+                if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
                         if (len == 0)
                                 len = -EFAULT;
                         break;
@@ -571,6 +573,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
 
                 total -= this;
                 len += this;
+                to_copy += this;
                 if (total == 0)
                         break;
         }