The while (words--) loop post-decrements words, so it underflows from
0 to UINT_MAX on exit.  The function then returns "words << 1", which
is either 0 (for odd-length transfers after words++) or 0xFFFFFFFE
(for even-length transfers).  Callers like __atapi_pio_bytes() depend
on the correct byte count to manage scatter-gather progress; a wrong
value causes ATAPI PIO transfer errors.

Fix by returning buflen instead of the corrupted words counter, matching
what ata_sff_data_xfer() does.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/ata/pata_ep93xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 192f75636d18..5b79a7a019ce 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -506,7 +506,7 @@ static unsigned int ep93xx_pata_data_xfer(struct ata_queued_cmd *qc,
 		words++;
 	}
 
-	return words << 1;
+	return buflen;
 }
 
 /* Note: original code is ata_devchk */
-- 
2.54.0