* Sarah Sharp | 2011-12-02 11:55:48 [-0800]:
>diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
>index 28d9b19..9dd4aae 100644
>--- a/drivers/usb/storage/uas.c
>+++ b/drivers/usb/storage/uas.c
>@@ -246,8 +246,10 @@ static void uas_stat_cmplt(struct urb *urb)
> cmnd = sdev->current_cmnd;
> else
> cmnd = scsi_find_tag(sdev, tag);
>- if (!cmnd)
>+ if (!cmnd) {
>+ usb_free_urb(urb);
The command is still out there, or else you wouldn't be here. Why should
the command just disappear?
You have a 1:1 mapping between scsi_cmd and your urbs
(cmd+status+read/write). Why not skip this scsi_find_tag() and use
->context for the back pointer?
If you keep it as it, you kfree() it again once the scsi layer takes the
command back. At that point you don't know if the status reponse got
back with an invalid TAG or the device crashed and didn't respond at
all.
> return;
>+ }
Sebastian
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
