Fix an oops in wusbhc_giveback_urb() if the wusb device had disconnected
while an urb was in progress. Also release the ref count obtained here.
Signed-off-by: David Vrabel <david.vrabel@xxxxxxx>
---
drivers/usb/wusbcore/devconnect.c | 2 ++
drivers/usb/wusbcore/wusbhc.c | 8 +++++---
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 386eaa2..fc1b05c 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -267,6 +267,8 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work)
mutex_lock(&wusbhc->mutex);
wusbhc_devconnect_acked(wusbhc, wusb_dev);
mutex_unlock(&wusbhc->mutex);
+
+ wusb_dev_put(wusb_dev);
}
/*
diff --git a/drivers/usb/wusbcore/wusbhc.c b/drivers/usb/wusbcore/wusbhc.c
index 0f0f5b9..c39ee21 100644
--- a/drivers/usb/wusbcore/wusbhc.c
+++ b/drivers/usb/wusbcore/wusbhc.c
@@ -336,14 +336,16 @@ EXPORT_SYMBOL_GPL(wusb_cluster_id_put);
void wusbhc_giveback_urb(struct wusbhc *wusbhc, struct urb *urb, int status)
{
struct wusb_dev *wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
-
- if (status == 0) {
+
+ if (status == 0 && wusb_dev) {
wusb_dev->entry_ts = jiffies;
- /* wusbhc_devconnect_acked() can't be called from from
+ /* wusbhc_devconnect_acked() can't be called from
atomic context so defer it to a work queue. */
if (!list_empty(&wusb_dev->cack_node))
queue_work(wusbd, &wusb_dev->devconnect_acked_work);
+ else
+ wusb_dev_put(wusb_dev);
}
usb_hcd_giveback_urb(&wusbhc->usb_hcd, urb, status);
--
1.5.4.3
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
