usb: gadget: u_ether: Fix incorrect S/G free in tx_complete
When tx_complete() is called back with a non-successful request,
as can happen with cable disconnection, the scatter-gather case
incorrectly executes the non-scatter-gather handling which treats
the req->context member as an SKB (when it is actually a pointer
to an skb_buff_head) and wrongly calls dev_kfree_skb_any() on it.
Since the completion happens in interrupt context, the effect of
this bad free is not immediately seen until the net_tx_action
thread later runs, actually executes kfree_skb() and crashes.
Fix this by properly handling the completed scatter-gather request
in both success and error cases so that skb_queue_purge() is called.
Change-Id: I2a31f3ca45fa0f0eee325edc4cadd8cb8096f9df
Signed-off-by:
Jack Pham <jackp@codeaurora.org>
Loading
Please register or sign in to comment