Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 825a8436 authored by Jack Pham's avatar Jack Pham
Browse files

usb: gadget: u_ether: Fix incorrect S/G free in tx_complete



When tx_complete() is called back with a non-successful request,
as can happen with cable disconnection, the scatter-gather case
incorrectly executes the non-scatter-gather handling which treats
the req->context member as an SKB (when it is actually a pointer
to an skb_buff_head) and wrongly calls dev_kfree_skb_any() on it.

Since the completion happens in interrupt context, the effect of
this bad free is not immediately seen until the net_tx_action
thread later runs, actually executes kfree_skb() and crashes.

Fix this by properly handling the completed scatter-gather request
in both success and error cases so that skb_queue_purge() is called.

Change-Id: I2a31f3ca45fa0f0eee325edc4cadd8cb8096f9df
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
parent a4ff7275
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment