If len > BUFFER_LEN and !xfer->rx_buf we end up calculating the tx buffer
address as

*tx_dma = xfer->tx_dma + xfer->len - BUFFER_SIZE;

which is constant; i.e.  we just send the last BUFFER_SIZE data over again
until we've reached the right number of bytes.

This patch gets around this by using the /requested/ length when
calculating addresses.

Note there's no way len != *plen when we calculate the rx buffer address
but conceptually we should be using *plen and I don't want someone to come
through later, see the calculations for rx and tx are different and "clean
up" back to what we had.
Signed-off-by: Ben Nizette <bn@niasdigital.com>
Cc: Haavard Skinnemoen <hskinnemoen@atmel.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>