From 70b8b076f7bb86512eee2aaed406a5a962575240 Mon Sep 17 00:00:00 2001 From: zhang sanshan Date: Sun, 17 Sep 2017 12:00:55 +0800 Subject: [PATCH] ANDROID: USB gadget: mtp: Fix hang in ioctl(MTP_RECEIVE_FILE) for WritePartialObject user space will hang at ioctl when copy file. ioctl(mFD, MTP_RECEIVE_FILE, (unsigned long)&mfr); length of read_req need rounded up to max packet size for usb_ep_queue, Otherwise the read request will never complete. Change-Id: Id8c6d7c44d1c16bb81dd77d3acc96ef2ab31f4c2 Signed-off-by: Mike Lockwood Signed-off-by: zhang sanshan --- drivers/usb/gadget/function/f_mtp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_mtp.c b/drivers/usb/gadget/function/f_mtp.c index 9515b2a7d0e0..54f7ebbf858e 100644 --- a/drivers/usb/gadget/function/f_mtp.c +++ b/drivers/usb/gadget/function/f_mtp.c @@ -825,7 +825,7 @@ static void receive_file_work(struct work_struct *data) struct usb_request *read_req = NULL, *write_req = NULL; struct file *filp; loff_t offset; - int64_t count; + int64_t count, len; int ret, cur_buf = 0; int r = 0; @@ -843,8 +843,10 @@ static void receive_file_work(struct work_struct *data) read_req = dev->rx_req[cur_buf]; cur_buf = (cur_buf + 1) % RX_REQ_MAX; - read_req->length = (count > MTP_BULK_BUFFER_SIZE - ? MTP_BULK_BUFFER_SIZE : count); + len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count); + if (len > MTP_BULK_BUFFER_SIZE) + len = MTP_BULK_BUFFER_SIZE; + read_req->length = len; dev->rx_done = 0; ret = usb_ep_queue(dev->ep_out, read_req, GFP_KERNEL); if (ret < 0) {