usb-storage: fill csw on cancel

When scsi requests are canceled fill the csw
(command status word) accordingly.

Buglink: https://bugs.launchpad.net/qemu/+bug/1901981
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20201105134112.25119-5-kraxel@redhat.com

hw/usb/dev-storage.c

@@ -327,6 +327,10 @@ static void usb_msd_request_cancelled(SCSIRequest *req)
     trace_usb_msd_cmd_cancel(req->tag);
 
     if (req == s->req) {
+        s->csw.sig = cpu_to_le32(0x53425355);
+        s->csw.tag = cpu_to_le32(req->tag);
+        s->csw.status = 1; /* error */
+
         scsi_req_unref(s->req);
         s->req = NULL;
         s->scsi_len = 0;