usb: gadget: u_ether: Fix memory corruption in TX path
When data aggregation is enabled, multiple skb buffers are copied
into a single USB request buffer. When ever a USB request queue
is failed, make sure that req->length is reset to 0. Otherwise
when the same request is used again, the stale length field is
used to access the request buffer. This would lead to memory
corruption.
The xmit function keeps the partial request at the beginning of
the queue. Always put the idle request at the back of the queue.
Change-Id: Idcd31e667b0bf261ab9a88f4a34464ccdf503e1b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
1 file changed