4659a2452b
If the endpoint companion descriptor is not the first descriptor in the extra descriptor buffer of a usb_host_endpoint, the loop in rpipe_epc_find will get its buffer pointer and remaining size values out of sync. The buffer ptr 'itr' is advanced by the descriptor's bLength field but the remaining size value 'itr_size' is decremented by the bDescriptorType field which is incorrect. This patch fixes the loop to decrement itr_size by bLength as it should. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>