usb: ci_udc: parse QTD before over-writing it

ci_udc only allocates a single QTD structure per EP. All data needs to be
extracted from the DTD prior to calling ci_ep_submit_next_request(), since
that fills the QTD with next transaction's parameters. Fix
handle_ep_complete() to extract the transaction (remaining) length before
kicking off the next transaction.

In practice, this only causes writes to UMS devices to fail for me. I may
have tested the final versions of my previous ci_udc patch only with
reads. More recently, I had patches applied locally that allocated a QTD
per USB request rather than per USB EP, although since that doesn't give
any performance benefit, I'm dropping those.

Fixes: 2813006fec ("usb: ci_udc: allow multiple buffer allocs per ep")
Signed-off-by: Stephen Warren <swarren@nvidia.com>

drivers/usb/gadget/ci_udc.c

@@ -424,6 +424,7 @@ static void handle_ep_complete(struct ci_ep *ep)
 	item = ci_get_qtd(num, in);
 	ci_invalidate_qtd(num);
 
+	len = (item->info >> 16) & 0x7fff;
 	if (item->info & 0xff)
 		printf("EP%d/%s FAIL info=%x pg0=%x\n",
 		       num, in ? "in" : "out", item->info, item->page0);
@@ -435,7 +436,6 @@ static void handle_ep_complete(struct ci_ep *ep)
 	if (!list_empty(&ep->queue))
 		ci_ep_submit_next_request(ep);
 
-	len = (item->info >> 16) & 0x7fff;
 	ci_req->req.actual = ci_req->req.length - len;
 	ci_debounce(ci_req, in);