The transferred length is incorrectly zeroed for cancelled isoc transfer TDs when the transfer ring stops on a cancelled TD with a 'Stop - Length Invalid' completion code. Length was always set to zero in these cases even if it should be set to the sum of the TRB transfer block lengths up to the TRB the ring stopped on, _excluding_ the one stopped on. No issues reported due to this isoc case. Found while inspecting related case in bulk transfer 'Stop - Length Invalid' handling. Change this so that 'Stop - Length Invalid' transfer completion cases always sum up TRB lengths instead of report a zero length. Signed-off-by: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> --- drivers/usb/host/xhci-ring.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index ffb3ebb72eaa..a12009ed1b36 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2439,7 +2439,9 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, requested = remaining; break; case COMP_STOPPED_LENGTH_INVALID: - requested = 0; + /* exclude stopped trb with invalid length from length sum */ + sum_trbs_for_length = true; + ep_trb_len = 0; remaining = 0; break; default: -- 2.25.1
