USB: gadget: f_mtp: dequeue request on error in mtp_read

In mtp_read(), if wait_event_interruptible() returns an error, we need to
remove the request from the EP queue.  Else, on the next call to mtp_read(), we
will attempt to enqueue the request again, potentially corrupting the
queue.  This is what happens with musb_gadget_queue(), which does not check for
duplicate requests.

Based on a similar change to f_adb.c

Signed-off-by: Mike Lockwood <lockwood@android.com>

diff --git a/drivers/usb/gadget/f_mtp.c b/drivers/usb/gadget/f_mtp.c
index 8128b203e76f4370b9f57d0866592c7fd4bf8a2c..92dd89b340bcf5b64c1ca31bc94658931f3f51c3 100644 (file)
--- a/drivers/usb/gadget/f_mtp.c
+++ b/drivers/usb/gadget/f_mtp.c
@@ -504,6 +504,7 @@ requeue_req:
        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
        if (ret < 0) {
                r = ret;
+               usb_ep_dequeue(dev->ep_out, req);
                goto done;
        }
        if (dev->state == STATE_BUSY) {