path: root/drivers
diff options
authorYauheni Kaliuta <yauheni.kaliuta@nokia.com>2011-04-05 16:55:25 +0300
committerGreg Kroah-Hartman <gregkh@suse.de>2011-04-13 15:44:01 -0700
commit505d1f69ec4f8697a74711fb3a01ed151fda3834 (patch)
tree5bbf4c66b5906d2e7f0031b42f1fa70d3763b7e9 /drivers
parent5a9443f08c83c294c5c806a689c1184b27cb26b3 (diff)
usb: gadget: eem: fix echo command processing
During processing of bunch of eem frames if "echo" command is found skb is cloned and the cloned version should be used to send reply. Unfortunately, the data of the original skb were actually used and the cloned skb is never freed. Using the cloned skb and freeing the skb in the completion callback for usb request. Signed-off-by: Yauheni Kaliuta <yauheni.kaliuta@nokia.com> Reviewed-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 95dd4662d6a8..b3c304290150 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -314,6 +314,9 @@ eem_unbind(struct usb_configuration *c, struct usb_function *f)
static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
+ struct sk_buff *skb = (struct sk_buff *)req->context;
+ dev_kfree_skb_any(skb);
@@ -428,10 +431,11 @@ static int eem_unwrap(struct gether *port,
skb_trim(skb2, len);
put_unaligned_le16(BIT(15) | BIT(11) | len,
skb_push(skb2, 2));
- skb_copy_bits(skb, 0, req->buf, skb->len);
- req->length = skb->len;
+ skb_copy_bits(skb2, 0, req->buf, skb2->len);
+ req->length = skb2->len;
req->complete = eem_cmd_complete;
req->zero = 1;
+ req->context = skb2;
if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
DBG(cdev, "echo response queue fail\n");

Privacy Policy