[PULL,2/2] usb: fix storage regression
diff mbox series

Message ID 20200716093119.10740-3-kraxel@redhat.com
State New
Headers show
Series
  • [PULL,1/2] vfio: fix use-after-free in display
Related show

Commit Message

Gerd Hoffmann July 16, 2020, 9:31 a.m. UTC
Fix the contition to figure whenever we need to wait for more data or
not.  Simply check the mode, if we are not in DATAIN state any more we
are done already and don't need to go ASYNC.

Fixes: 7ad3d51ebb8a ("usb: add short-packet handling to usb-storage driver")
Reported-by: Sai Pavan Boddu <saipava@xilinx.com>
Tested-by: Paul Zimmerman <pauldzim@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200713062712.1476-1-kraxel@redhat.com
---
 hw/usb/dev-storage.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

BALATON Zoltan July 16, 2020, 9:57 a.m. UTC | #1
On Thu, 16 Jul 2020, Gerd Hoffmann wrote:
> Fix the contition to figure whenever we need to wait for more data or

Typo: contition -> condition

Regards,
BALATON Zoltan

> not.  Simply check the mode, if we are not in DATAIN state any more we
> are done already and don't need to go ASYNC.
>
> Fixes: 7ad3d51ebb8a ("usb: add short-packet handling to usb-storage driver")
> Reported-by: Sai Pavan Boddu <saipava@xilinx.com>
> Tested-by: Paul Zimmerman <pauldzim@gmail.com>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Message-id: 20200713062712.1476-1-kraxel@redhat.com
> ---
> hw/usb/dev-storage.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
> index 2ed6a8df2413..405a4ccfe700 100644
> --- a/hw/usb/dev-storage.c
> +++ b/hw/usb/dev-storage.c
> @@ -546,8 +546,7 @@ static void usb_msd_handle_data(USBDevice *dev, USBPacket *p)
>                     }
>                 }
>             }
> -            if (p->actual_length < p->iov.size && (p->short_not_ok ||
> -                    s->scsi_len >= p->ep->max_packet_size)) {
> +            if (p->actual_length < p->iov.size && s->mode == USB_MSDM_DATAIN) {
>                 DPRINTF("Deferring packet %p [wait data-in]\n", p);
>                 s->packet = p;
>                 p->status = USB_RET_ASYNC;
>

Patch
diff mbox series

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 2ed6a8df2413..405a4ccfe700 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -546,8 +546,7 @@  static void usb_msd_handle_data(USBDevice *dev, USBPacket *p)
                     }
                 }
             }
-            if (p->actual_length < p->iov.size && (p->short_not_ok ||
-                    s->scsi_len >= p->ep->max_packet_size)) {
+            if (p->actual_length < p->iov.size && s->mode == USB_MSDM_DATAIN) {
                 DPRINTF("Deferring packet %p [wait data-in]\n", p);
                 s->packet = p;
                 p->status = USB_RET_ASYNC;