tree 71c37757ef7ae615c1a237707b158236898ad650
parent 32f9c9af1335b121f4e1857ff61e85cffb27a1a6
author Pavankumar Kondeti <pkondeti@codeaurora.org> 1364820212 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> 1372227534 -0700

usb: gadget: u_ether: Fix memory corruption in TX path

When data aggregation is enabled, multiple skb buffers are copied
into a single USB request buffer.  When ever a USB request queue
is failed, make sure that req->length is reset to 0.  Otherwise
when the same request is used again, the stale length field is used
to access the request buffer.  This would lead to memory corruption.

The xmit function keeps the partial request at the beginning of the
queue.  Always put the idle request at the back of the queue.

CRs-Fixed: 469436
Change-Id: Idcd31e667b0bf261ab9a88f4a34464ccdf503e1b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>