Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21a509d2 authored by Vamsi Krishna's avatar Vamsi Krishna Committed by Sivasri Kumar Vanka
Browse files

usb: rndis: Fix zero length skbs in up-link 



'Commit 72ffa18bd73c ("usb: Add support for rndis uplink
aggregation")' introduced issue which can result in zero length
skbs being queued to network stack. Fix this by checking skb
length with data length instead of message length to determine
the final skb.

Change-Id: I8bdc3accfbc22527d08382cc1003d726a73bdd9b
Signed-off-by: default avatarVamsi Krishna <vskrishn@codeaurora.org>
Signed-off-by: default avatarSivasri Kumar Vanka <sivasri@codeaurora.org>
parent 3e1e0d09

drivers/usb/gadget/function/rndis.c

+2 −10
Original line number Diff line number Diff line
@@ -1145,15 +1145,6 @@ int rndis_rm_hdr(struct gether *port, 
		struct sk_buff          *skb2;

		u32             msg_len, data_offset, data_len;



		/* some rndis hosts send extra byte to avoid zlp, ignore it */

		if (skb->len == 1) {

			if (num_pkts > rndis_ul_max_pkt_per_xfer_rcvd)

				rndis_ul_max_pkt_per_xfer_rcvd = num_pkts;



			dev_kfree_skb_any(skb);

			return 0;

		}



		if (skb->len < sizeof(*hdr)) {

			pr_err("invalid rndis pkt: skblen:%u hdr_len:%zu",

					skb->len, sizeof(*hdr));
@@ -1186,7 +1177,8 @@ int rndis_rm_hdr(struct gether *port, 


		skb_pull(skb, data_offset + 8);



		if (msg_len == skb->len) {

		if (data_len == skb->len ||

				data_len == (skb->len - 1)) {

			skb_trim(skb, data_len);

			break;

		}