Merge "usb: gadget: u_ether: Fix incorrect S/G free in tx_complete" (7d3fa3cc) · Commits · e / devices / android_kernel_sony_msm8994

drivers/usb/gadget/u_ether.c

+21 −20

Original line number	Diff line number	Diff line
		@@ -643,6 +643,7 @@ static void tx_complete(struct usb_ep ep, struct usb_request req)
		struct net_device *net;
		struct usb_request *new_req;
		struct usb_ep *in;
		int n = 1;
		int length;
		int retval;

		@@ -668,35 +669,35 @@ static void tx_complete(struct usb_ep ep, struct usb_request req)
		case -ESHUTDOWN: /* disconnect etc */
		break;
		case 0:
		if (!req->zero)
		dev->net->stats.tx_bytes += req->length-1;
		else
		dev->net->stats.tx_bytes += req->length;
		}

		if (req->num_sgs) {
		struct sg_ctx *sg_ctx = req->context;
		int n = skb_queue_len(&sg_ctx->skbs);

		dev->net->stats.tx_bytes += req->length;
		dev->net->stats.tx_packets += n;
		n = skb_queue_len(&sg_ctx->skbs);
		dev->tx_aggr_cnt[n-1]++;

		skb_queue_purge(&sg_ctx->skbs);
		/* sg_ctx is only accessible here, can use lock-free version */
		__skb_queue_purge(&sg_ctx->skbs);
		}

		dev->net->stats.tx_packets += n;

		spin_lock(&dev->req_lock);
		list_add_tail(&req->list, &dev->tx_reqs);
		spin_unlock(&dev->req_lock);

		if (req->num_sgs) {
		if (!req->status)
		queue_work(uether_tx_wq, &dev->tx_work);

		spin_unlock(&dev->req_lock);
		return;
		}

		if (!req->zero)
		dev->net->stats.tx_bytes += req->length-1;
		else
		dev->net->stats.tx_bytes += req->length;
		}
		dev->net->stats.tx_packets++;

		spin_lock(&dev->req_lock);
		list_add_tail(&req->list, &dev->tx_reqs);

		if (dev->port_usb->multi_pkt_xfer && !req->context) {
		dev->no_tx_req_used--;
		req->length = 0;