staging: r8188eu: Use new usb_control_msg_recv/send()

Replace usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core in usbctrl_vendorreq().

Suggested-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Fabio M. De Francesco <[email protected]>

---

Thanks to Pavel Skripkin <[email protected]> for his review of the RFC patch.

drivers/staging/r8188eu/hal/usb_ops_linux.c | 25 ++++++++++-----------

1 file changed, 12 insertions(+), 13 deletions(-)

drivers/staging/r8188eu/hal/usb_ops_linux.c +12 -14

index a93d5cfe4635..6f51660b967a 100644
@@ -15,9 +15,8 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        struct adapter  *adapt = pintfhdl->padapter;
        struct dvobj_priv  *dvobjpriv = adapter_to_dvobj(adapt);
        struct usb_device *udev = dvobjpriv->pusbdev;
-       unsigned int pipe;
+       u8 pipe;
        int status = 0;
-       u8 reqtype;
        u8 *pIo_buf;
        int vendorreq_times = 0;
 

@@ -44,22 +43,22 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        }
 
        while (++vendorreq_times <= MAX_USBCTRL_VENDORREQ_TIMES) {
-               memset(pIo_buf, 0, len);
-
                if (requesttype == 0x01) {
-                       pipe = usb_rcvctrlpipe(udev, 0);/* read_in */
-                       reqtype =  REALTEK_USB_VENQT_READ;
+                       status = usb_control_msg_recv(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+                                                     REALTEK_USB_VENQT_READ, value,
+                                                     REALTEK_USB_VENQT_CMD_IDX,
+                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     GFP_KERNEL);
                } else {
-                       pipe = usb_sndctrlpipe(udev, 0);/* write_out */
-                       reqtype =  REALTEK_USB_VENQT_WRITE;
                        memcpy(pIo_buf, pdata, len);
+                       status = usb_control_msg_send(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+                                                     REALTEK_USB_VENQT_WRITE, value,
+                                                     REALTEK_USB_VENQT_CMD_IDX,
+                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     GFP_KERNEL);
                }
 
-               status = usb_control_msg(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
-                                        reqtype, value, REALTEK_USB_VENQT_CMD_IDX,
-                                        pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT);
-
-               if (status == len) {   /*  Success this control transfer. */
+               if (!status) {   /*  Success this control transfer. */
                        rtw_reset_continual_urb_error(dvobjpriv);
                        if (requesttype == 0x01)
                                memcpy(pdata, pIo_buf,  len);
--

2.32.0

Quoted 64 lines · Fabio M. De Francesco

Replace usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core in usbctrl_vendorreq().

Suggested-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Fabio M. De Francesco <[email protected]>

---

Thanks to Pavel Skripkin <[email protected]> for his review of the RFC patch.

drivers/staging/r8188eu/hal/usb_ops_linux.c | 25 ++++++++++-----------

1 file changed, 12 insertions(+), 13 deletions(-)

drivers/staging/r8188eu/hal/usb_ops_linux.c +12 -14

index a93d5cfe4635..6f51660b967a 100644
@@ -15,9 +15,8 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        struct adapter  *adapt = pintfhdl->padapter;
        struct dvobj_priv  *dvobjpriv = adapter_to_dvobj(adapt);
        struct usb_device *udev = dvobjpriv->pusbdev;
-       unsigned int pipe;
+       u8 pipe;
        int status = 0;
-       u8 reqtype;
        u8 *pIo_buf;
        int vendorreq_times = 0;
 

@@ -44,22 +43,22 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        }
 
        while (++vendorreq_times <= MAX_USBCTRL_VENDORREQ_TIMES) {
-               memset(pIo_buf, 0, len);
-
                if (requesttype == 0x01) {
-                       pipe = usb_rcvctrlpipe(udev, 0);/* read_in */
-                       reqtype =  REALTEK_USB_VENQT_READ;
+                       status = usb_control_msg_recv(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+                                                     REALTEK_USB_VENQT_READ, value,
+                                                     REALTEK_USB_VENQT_CMD_IDX,
+                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     GFP_KERNEL);
                } else {
-                       pipe = usb_sndctrlpipe(udev, 0);/* write_out */
-                       reqtype =  REALTEK_USB_VENQT_WRITE;
                        memcpy(pIo_buf, pdata, len);
+                       status = usb_control_msg_send(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+                                                     REALTEK_USB_VENQT_WRITE, value,
+                                                     REALTEK_USB_VENQT_CMD_IDX,
+                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     GFP_KERNEL);
                }
 
-               status = usb_control_msg(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
-                                        reqtype, value, REALTEK_USB_VENQT_CMD_IDX,
-                                        pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT);
-
-               if (status == len) {   /*  Success this control transfer. */
+               if (!status) {   /*  Success this control transfer. */
                        rtw_reset_continual_urb_error(dvobjpriv);
                        if (requesttype == 0x01)
                                memcpy(pdata, pIo_buf,  len);
--

Quoted 2 lines

2.32.0

Dear Fabio,

Thanks for the patch. Sorry, but for some reason with my N10-Nano I can't get a connection at all with this patch applied - it just won't associate with my network. Interface shows up and no OOPS in log, but just disassociates/no IP address/interface down etc. so perhaps semantics differ slightly here somehow? Tried two separate rollbacks/builds/runs just to make sure I wasn't losing my mind :-)

Regards,
Phil

Quoted 78 lines · CEST Phillip Potter

Quoted 64 lines · Fabio M. De Francesco

Replace usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core in usbctrl_vendorreq().

Suggested-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Fabio M. De Francesco <[email protected]>

---

Thanks to Pavel Skripkin <[email protected]> for his review of the RFC patch.

drivers/staging/r8188eu/hal/usb_ops_linux.c | 25 ++++++++++-----------

1 file changed, 12 insertions(+), 13 deletions(-)

drivers/staging/r8188eu/hal/usb_ops_linux.c +12 -14

index a93d5cfe4635..6f51660b967a 100644
@@ -15,9 +15,8 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        struct adapter  *adapt = pintfhdl->padapter;
        struct dvobj_priv  *dvobjpriv = adapter_to_dvobj(adapt);
        struct usb_device *udev = dvobjpriv->pusbdev;
-       unsigned int pipe;
+       u8 pipe;
        int status = 0;
-       u8 reqtype;
        u8 *pIo_buf;
        int vendorreq_times = 0;
 

@@ -44,22 +43,22 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        }
 
        while (++vendorreq_times <= MAX_USBCTRL_VENDORREQ_TIMES) {
-               memset(pIo_buf, 0, len);
-
                if (requesttype == 0x01) {
-                       pipe = usb_rcvctrlpipe(udev, 0);/* read_in */
-                       reqtype =  REALTEK_USB_VENQT_READ;
+                       status = usb_control_msg_recv(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+                                                     REALTEK_USB_VENQT_READ, value,
+                                                     REALTEK_USB_VENQT_CMD_IDX,
+                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     GFP_KERNEL);
                } else {
-                       pipe = usb_sndctrlpipe(udev, 0);/* write_out */
-                       reqtype =  REALTEK_USB_VENQT_WRITE;
                        memcpy(pIo_buf, pdata, len);
+                       status = usb_control_msg_send(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+                                                     REALTEK_USB_VENQT_WRITE, value,
+                                                     REALTEK_USB_VENQT_CMD_IDX,
+                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     GFP_KERNEL);
                }
 
-               status = usb_control_msg(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
-                                        reqtype, value, REALTEK_USB_VENQT_CMD_IDX,
-                                        pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT);
-
-               if (status == len) {   /*  Success this control transfer. */
+               if (!status) {   /*  Success this control transfer. */
                        rtw_reset_continual_urb_error(dvobjpriv);
                        if (requesttype == 0x01)
                                memcpy(pdata, pIo_buf,  len);
--

Quoted 2 lines

2.32.0

Dear Fabio,

Thanks for the patch. Sorry, but for some reason with my N10-Nano I can't get a connection at all with this patch applied - it just won't associate with my network. Interface shows up and no OOPS in log, but just disassociates/no IP address/interface down etc. so perhaps semantics differ slightly here somehow? Tried two separate rollbacks/builds/runs just to make sure I wasn't losing my mind :-)

Quoted 3 lines

Regards,
Phil

Dear Philip,

Thanks for testing. As I wrote in my RFC, I strongly suspected that I was not able to correctly understand the semantics of the new API. I'll try to read the code anew and try to understand what is wrong here.

However, I also think that I won't be able to figure it out. Maybe that I have to wait for Greg to give me some hint about what are the errors in using usb_control_msg_send/recv() the way I did.

Anyway, thanks a lot for the time you spent testing.

Regards,

Fabio

I think that I've inadvertently switched the order by which usb_control_msg_send() and memcpy() are called. I'm very sorry for not doing my tests, but (as I had said before) at the moment I don't have my device with me.

Quoted 3 lines

I think that I've inadvertently switched the order by which usb_control_msg_send() and memcpy() are called. I'm very sorry for not doing my tests, but (as I had said before) at the moment I don't have my device with me.

No, I did not switch them. There must be something else... Sorry for the noise.

Fabio

Quoted 10 lines · Fabio M. De Francesco

Quoted 3 lines · CEST Fabio M. De Francesco

I think that I've inadvertently switched the order by which usb_control_msg_send() and memcpy() are called. I'm very sorry for not doing my tests, but (as I had said before) at the moment I don't have my device with me.

No, I did not switch them. There must be something else... Sorry for the noise.

Fabio

Hi,

'usb_control_msg_recv()' looks like:

int usb_control_msg_recv(struct usb_device *dev, __u8 endpoint, ...)

{
	unsigned int pipe = usb_rcvctrlpipe(dev, endpoint);
	...
	ret = usb_control_msg(dev, pipe, ...);

'usb_control_msg()' looks like:
int usb_control_msg(struct usb_device *dev, unsigned int pipe, ...) {

The difference is that one expect an 'endpoint' (and compute the pipe from it), and the other expect a 'pipe'.

Also, in your code, 'pipe' looks un-initialized.

So, my guess is that you should rename 'pipe' into 'endpoint' (to keep the semantic),
have "endpoint = 0;" somewhere and pass it to usb_control_msg_{recv|send}.
Or just remove 'pipe' and pass an explicit 0 directly.

Not sure it is enough, but it looks like a difference between before and after your patch.

just my 2c,
CJ

Not related to my patch... why Linux has u8 and __u8? What are the different use cases they are meant for?

Your 2c are worth much more than how much you think :)

Thanks very much,

Fabio

Quoted 3 lines

just my 2c,
CJ

Dear Philip,

I think that I've inadvertently switched the order by which usb_control_msg_send() and memcpy() are called. I'm very sorry for not doing my tests, but (as I had said before) at the moment I don't have my device with me.

I'm about to send a v2 series.

Thanks very much for testing on my behalf.

Regards,

Fabio

Replace usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core in usbctrl_vendorreq().

Suggested-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Fabio M. De Francesco <[email protected]>

---

Thanks to Pavel Skripkin <[email protected]> for his review of the RFC patch.

drivers/staging/r8188eu/hal/usb_ops_linux.c | 25 ++++++++++-----------

1 file changed, 12 insertions(+), 13 deletions(-)

drivers/staging/r8188eu/hal/usb_ops_linux.c +11 -8

index a93d5cfe4635..6f51660b967a 100644
@@ -15,9 +15,8 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
  	struct adapter	*adapt = pintfhdl->padapter;
  	struct dvobj_priv  *dvobjpriv = adapter_to_dvobj(adapt);
  	struct usb_device *udev = dvobjpriv->pusbdev;
-	unsigned int pipe;
+	u8 pipe;
  	int status = 0;
-	u8 reqtype;
  	u8 *pIo_buf;
  	int vendorreq_times = 0;
 

@@ -44,22 +43,22 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
  	}
 
  	while (++vendorreq_times <= MAX_USBCTRL_VENDORREQ_TIMES) {
-		memset(pIo_buf, 0, len);
-
  		if (requesttype == 0x01) {
-			pipe = usb_rcvctrlpipe(udev, 0);/* read_in */
-			reqtype =  REALTEK_USB_VENQT_READ;
+			status = usb_control_msg_recv(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+						      REALTEK_USB_VENQT_READ, value,
+						      REALTEK_USB_VENQT_CMD_IDX,
+						      pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+						      GFP_KERNEL);
  		} else {
-			pipe = usb_sndctrlpipe(udev, 0);/* write_out */
-			reqtype =  REALTEK_USB_VENQT_WRITE;
  			memcpy(pIo_buf, pdata, len);
+			status = usb_control_msg_send(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
+						      REALTEK_USB_VENQT_WRITE, value,
+						      REALTEK_USB_VENQT_CMD_IDX,
+						      pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+						      GFP_KERNEL);
  		}

Quoted 10 lines · Fabio M. De Francesco

Replace usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core in usbctrl_vendorreq().

Suggested-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Fabio M. De Francesco <[email protected]>

---

Thanks to Pavel Skripkin <[email protected]> for his review of the RFC patch.

Quoted 5 lines

drivers/staging/r8188eu/hal/usb_ops_linux.c | 25 ++++++++++-----------

1 file changed, 12 insertions(+), 13 deletions(-)

[...]

Hi, Fabio!

Christophe is right about semantic part.

Also,

if (!status) {

} else {
	if (status < 0) {		<-
					  |
	} else {			  |
					  |
	}				<-
}					

Extra if-else is not needed, since status can be 0 and < 0, there is no 3rd state, like it was before.

With regards,
Pavel Skripkin

Quoted 11 lines · CEST Pavel Skripkin

Quoted 10 lines · Fabio M. De Francesco

Replace usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core in usbctrl_vendorreq().

Suggested-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Fabio M. De Francesco <[email protected]>

---

Thanks to Pavel Skripkin <[email protected]> for his review of the RFC patch.

Quoted 8 lines

Quoted 5 lines

drivers/staging/r8188eu/hal/usb_ops_linux.c | 25 ++++++++++-----------

1 file changed, 12 insertions(+), 13 deletions(-)

[...]

Hi, Fabio!

Christophe is right about semantic part.

Hi Pavel,

I haven't yet read Christophe's message (but I'm going to do it ASAP). I hope he found out what is wrong with the code, what made Phil's tests fail.

Quoted 12 lines

Also,

if (!status) {

} else {
	if (status < 0) {		<-
					  |
	} else {			  |
					  |
	}				<-
}					

Quoted 1 line

Extra if-else is not needed, since status can be 0 and < 0, there is no 3rd state, like it was before.

Correct, thanks!

Now I read the following from the documentation of the new API...

"Return: If successful, 0 is returned, Otherwise, a negative error number."

I'll remove that status < 0 check and whatever else is no more necessary. Thanks, again :)

Regards,

Btw, not related to your patch, but I start think, that this check:

	if (!pIo_buf) {
		DBG_88E("[%s] pIo_buf == NULL\n", __func__);
		status = -ENOMEM;
		goto release_mutex;
	}

Should be wrapped as

	if (WARN_ON(unlikely(!pIo_buf)) {
		...
	}

Since usb_vendor_req_buf is initialized in ->probe() and I can't see possible calltrace, which can cause zeroing this pointer.

Something _completely_ wrong is going on if usb_vendor_req_buf is NULL, and we should complain loud about it. What do you think?

With regards,
Pavel Skripkin

Quoted 16 lines · CEST Pavel Skripkin

Btw, not related to your patch, but I start think, that this check:

	if (!pIo_buf) {
		DBG_88E("[%s] pIo_buf == NULL\n", __func__);
		status = -ENOMEM;
		goto release_mutex;
	}

Should be wrapped as

	if (WARN_ON(unlikely(!pIo_buf)) {
		...
	}

Quoted 1 line

Since usb_vendor_req_buf is initialized in ->probe() and I can't see possible calltrace, which can cause zeroing this pointer.

I see that usb_vendor_req_buf is initialized in rtw_init_intf_priv(). It depends on a kzalloc() success on allocating memory. Obviously it could fail to allocate. If it fails, rtw_init_intf_priv() returns _FAIL to its caller(s) (whichever they are - I didn't go too deep in understanding the possible calls chains).

Quoted 17 lines · Fabio M. De Francesco

Quoted 16 lines · CEST Pavel Skripkin

Btw, not related to your patch, but I start think, that this check:

	if (!pIo_buf) {
		DBG_88E("[%s] pIo_buf == NULL\n", __func__);
		status = -ENOMEM;
		goto release_mutex;
	}

Should be wrapped as

	if (WARN_ON(unlikely(!pIo_buf)) {
		...
	}

Quoted 8 lines

Quoted 2 lines

Since usb_vendor_req_buf is initialized in ->probe() and I can't see possible calltrace, which can cause zeroing this pointer.

I see that usb_vendor_req_buf is initialized in rtw_init_intf_priv(). It depends on a kzalloc() success on allocating memory. Obviously it could fail to allocate. If it fails, rtw_init_intf_priv() returns _FAIL to its caller(s) (whichever they are - I didn't go too deep in understanding the possible calls chains).

Call chain is the most interesting part here :)

     rtw_drv_init()		<-- probe()
       usb_dvobj_init()
	rtw_init_intf_priv()

If kzalloc fails, then whole ->probe() routine fails, i.e device will be disconnected.

There is no read() calls before rtw_init_intf_priv(), so
if kzalloc() call was successful, there is no way how usb_vendor_req_buf can be NULL, since read() can happen only in case of successfully connected device.

Anyway, it can be NULL in case of out-of-bound write or smth else,

but
there is no explicit usb_alloc_vendor_req_buf = NULL in this driver. We should complain about completely wrong driver behavior, IMO :)

Does it make sense?

With regards,
Pavel Skripkin

After replacing usb_control_msg() with the new usb_control_msg_recv() and usb_control_msg_send() API of USB Core, remove camelcase from the pIo_buf variable that is passed as argument to the new API and remove the initial 'p' (that probably stands for "pointer") from the same pIo_buf and from the pintfhdl and pdata arguments of usbctrl_vendorreq().

Signed-off-by Fabio M. De Francesco <[email protected]>

---
 drivers/staging/r8188eu/hal/usb_ops_linux.c | 26 ++++++++++-----------
 1 file changed, 13 insertions(+), 13 deletions(-)

drivers/staging/r8188eu/hal/usb_ops_linux.c +13 -14

index 6f51660b967a..5ce31ae18ed8 100644
@@ -10,14 +10,14 @@
 #include "../include/recv_osdep.h"
 #include "../include/rtl8188e_hal.h"
 
-static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata, u16 len, u8 requesttype)
+static int usbctrl_vendorreq(struct intf_hdl *intfhdl, u16 value, void *data, u16 len, u8 requesttype)
 {
-       struct adapter  *adapt = pintfhdl->padapter;
+       struct adapter  *adapt = intfhdl->padapter;
        struct dvobj_priv  *dvobjpriv = adapter_to_dvobj(adapt);
        struct usb_device *udev = dvobjpriv->pusbdev;
        u8 pipe;
        int status = 0;
-       u8 *pIo_buf;
+       u8 *io_buf;
        int vendorreq_times = 0;
 
        if ((adapt->bSurpriseRemoved) || (adapt->pwrctrlpriv.pnp_bstop_trx)) {

@@ -34,10 +34,10 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
        mutex_lock(&dvobjpriv->usb_vendor_req_mutex);
 
        /*  Acquire IO memory for vendorreq */
-       pIo_buf = dvobjpriv->usb_vendor_req_buf;
+       io_buf = dvobjpriv->usb_vendor_req_buf;
 
-       if (!pIo_buf) {
-               DBG_88E("[%s] pIo_buf == NULL\n", __func__);
+       if (!io_buf) {
+               DBG_88E("[%s] io_buf == NULL\n", __func__);
                status = -ENOMEM;
                goto release_mutex;
        }

@@ -47,25 +47,25 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
                        status = usb_control_msg_recv(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
                                                      REALTEK_USB_VENQT_READ, value,
                                                      REALTEK_USB_VENQT_CMD_IDX,
-                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     io_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
                                                      GFP_KERNEL);
                } else {
-                       memcpy(pIo_buf, pdata, len);
+                       memcpy(io_buf, data, len);
                        status = usb_control_msg_send(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
                                                      REALTEK_USB_VENQT_WRITE, value,
                                                      REALTEK_USB_VENQT_CMD_IDX,
-                                                     pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
+                                                     io_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT,
                                                      GFP_KERNEL);
                }
 
                if (!status) {   /*  Success this control transfer. */
                        rtw_reset_continual_urb_error(dvobjpriv);
                        if (requesttype == 0x01)
-                               memcpy(pdata, pIo_buf,  len);
+                               memcpy(data, io_buf,  len);
                } else { /*  error cases */
                        DBG_88E("reg 0x%x, usb %s %u fail, status:%d value=0x%x, vendorreq_times:%d\n",
                                value, (requesttype == 0x01) ? "read" : "write",
-                               len, status, *(u32 *)pdata, vendorreq_times);
+                               len, status, *(u32 *)data, vendorreq_times);
 
                        if (status < 0) {
                                if (status == (-ESHUTDOWN) || status == -ENODEV) {

@@ -77,8 +77,8 @@ static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void *pdata,
                        } else { /*  status != len && status >= 0 */
                                if (status > 0) {
                                        if (requesttype == 0x01) {
-                                               /*  For Control read transfer, we have to copy the read data from pIo_buf to pdata. */
-                                               memcpy(pdata, pIo_buf,  len);
+                                               /*  For Control read transfer, we have to copy the read data from io_buf to data. */
+                                               memcpy(data, io_buf,  len);
                                        }
                                }
                        }
--

2.32.0