usb: gadget: uvc: fix sg handling in error case
authorDan Vacura <w36195@motorola.com>
Tue, 18 Oct 2022 21:50:39 +0000 (16:50 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Nov 2022 14:59:11 +0000 (23:59 +0900)
commit80ff4ef777374188377abdff9623878b89edf287
treefefa4586328e2d5d454bb0ffb7b0f63126de45ca
parent555011f6b27b38202a98030f7c5546b0ec18766f
usb: gadget: uvc: fix sg handling in error case

commit 0a0a2760b04814428800d48281a447a7522470ad upstream.

If there is a transmission error the buffer will be returned too early,
causing a memory fault as subsequent requests for that buffer are still
queued up to be sent. Refactor the error handling to wait for the final
request to come in before reporting back the buffer to userspace for all
transfer types (bulk/isoc/isoc_sg). This ensures userspace knows if the
frame was successfully sent.

Fixes: e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Vacura <w36195@motorola.com>
Link: https://lore.kernel.org/r/20221018215044.765044-4-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/uvc_queue.c
drivers/usb/gadget/function/uvc_video.c