Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f675347a authored by Dov Levenglick's avatar Dov Levenglick
Browse files

usb: gadget: proper skb_reserve usage 



Only calls skb_reserve once, after the skb is allocated.
This avoids a situation where the head is constantly
progressing towards the end - thereby causing an skb_panic.

Change-Id: I90375673cd8e2e442a2612ca9b4ca58b7080f206
Signed-off-by: default avatarDov Levenglick <dovl@codeaurora.org>
parent 47d53bf2

drivers/usb/gadget/u_bam.c

+2 −4
Original line number Diff line number Diff line
@@ -239,6 +239,8 @@ static struct sk_buff *gbam_alloc_skb_from_pool(struct gbam_port *port) 
		skb = alloc_skb(bam_mux_rx_req_size + BAM_MUX_HDR, GFP_ATOMIC);

		if (!skb)

			pr_err("%s: alloc skb failed\n", __func__);

		else

			skb_reserve(skb, BAM_MUX_HDR);

	} else {

		pr_debug("%s: pull skb from pool\n", __func__);

		skb = __skb_dequeue(&d->rx_skb_idle);
@@ -605,8 +607,6 @@ gbam_epout_complete(struct usb_ep *ep, struct usb_request *req) 
		spin_unlock(&port->port_lock_ul);

		return;

	}

	skb_reserve(skb, BAM_MUX_HDR);



	req->buf = skb->data;

	req->length = bam_mux_rx_req_size;

	req->context = skb;
@@ -670,8 +670,6 @@ static void gbam_start_rx(struct gbam_port *port) 
		spin_lock_irqsave(&port->port_lock_ul, flags);

		if (!skb)

			break;

		skb_reserve(skb, BAM_MUX_HDR);



		list_del(&req->list);

		req->buf = skb->data;

		req->length = bam_mux_rx_req_size;

drivers/usb/gadget/u_bam_data.c

+3 −8
Original line number Diff line number Diff line
@@ -183,16 +183,15 @@ static struct sk_buff *bam_data_alloc_skb_from_pool( 
		 */

		pr_debug("%s: allocate skb\n", __func__);

		skb = alloc_skb(d->rx_buffer_size + BAM_MUX_HDR, GFP_ATOMIC);

		if (!skb) {

		if (!skb)

			pr_err("%s: alloc skb failed\n", __func__);

			goto alloc_exit;

		}

		else

			skb_reserve(skb, BAM_MUX_HDR);

	} else {

		pr_debug("%s: pull skb from pool\n", __func__);

		skb = __skb_dequeue(&d->rx_skb_idle);

	}



alloc_exit:

	return skb;

}
@@ -299,8 +298,6 @@ static void bam_data_start_rx(struct bam_data_port *port) 
		skb = bam_data_alloc_skb_from_pool(port);

		if (!skb)

			break;

		skb_reserve(skb, BAM_MUX_HDR);



		list_del(&req->list);

		req->buf = skb->data;

		req->length = d->rx_buffer_size;
@@ -385,8 +382,6 @@ static void bam_data_epout_complete(struct usb_ep *ep, struct usb_request *req) 
		list_add_tail(&req->list, &d->rx_idle);

		return;

	}

	skb_reserve(skb, BAM_MUX_HDR);



	req->buf = skb->data;

	req->length = d->rx_buffer_size;

	req->context = skb;