usb: gadget: u_ether: Fix memory corruption in TX path
When data aggregation is enabled, multiple skb buffers are copied
into a single USB request buffer. When ever a USB request queue
is failed, make sure that req->length is reset to 0. Otherwise
when the same request is used again, the stale length field is used
to access the request buffer. This would lead to memory corruption.
The xmit function keeps the partial request at the beginning of the
queue. Always put the idle request at the back of the queue.
CRs-Fixed: 469436
Change-Id: Idcd31e667b0bf261ab9a88f4a34464ccdf503e1b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
1 file changed