diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c
index 815ce7b262ca408cc337f683f097a8afa992d1e7..832606f5e4416d836a76f786e8c8cc0c40d5c606 100644
--- a/drivers/usb/gadget/ci_udc.c
+++ b/drivers/usb/gadget/ci_udc.c
@@ -321,7 +321,7 @@ static void ci_debounce(struct ci_ep *ep, int in)
 	if (addr == ba)
 		return;		/* not a bounce */
 
-	memcpy(ep->req.buf, ep->b_buf, ep->req.length);
+	memcpy(ep->req.buf, ep->b_buf, ep->req.actual);
 free:
 	/* Large payloads use allocated buffer, free it. */
 	if (ep->b_buf != ep->b_fast)
@@ -388,7 +388,7 @@ static void handle_ep_complete(struct ci_ep *ep)
 		       num, in ? "in" : "out", item->info, item->page0);
 
 	len = (item->info >> 16) & 0x7fff;
-	ep->req.length -= len;
+	ep->req.actual = ep->req.length - len;
 	ci_debounce(ep, in);
 
 	DBG("ept%d %s complete %x\n",