WUSB: fix oops when completing URBs for disconnected devices
authorDavid Vrabel <david.vrabel@csr.com>
Wed, 8 Apr 2009 17:36:32 +0000 (17:36 +0000)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 17 Apr 2009 17:50:28 +0000 (10:50 -0700)
Fix an oops in wusbhc_giveback_urb() if the wusb device had disconnected
while an urb was in progress. Also release the ref count obtained here.

Signed-off-by: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/wusbcore/devconnect.c
drivers/usb/wusbcore/wusbhc.c

index 63f200e4efb10ae4b4131933e27522fddddc93cf..4ac4300a3f9aa9e2f173c42209f65585acf97792 100644 (file)
@@ -267,6 +267,8 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work)
        mutex_lock(&wusbhc->mutex);
        wusbhc_devconnect_acked(wusbhc, wusb_dev);
        mutex_unlock(&wusbhc->mutex);
+
+       wusb_dev_put(wusb_dev);
 }
 
 /*
index 07c63a31c799d50dda16eb7af74ed8daca033b12..3638cc68529f32bd663f490e34f31ad24bc8eeac 100644 (file)
@@ -339,13 +339,15 @@ void wusbhc_giveback_urb(struct wusbhc *wusbhc, struct urb *urb, int status)
 {
        struct wusb_dev *wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
 
-       if (status == 0) {
+       if (status == 0 && wusb_dev) {
                wusb_dev->entry_ts = jiffies;
 
-               /* wusbhc_devconnect_acked() can't be called from from
+               /* wusbhc_devconnect_acked() can't be called from
                   atomic context so defer it to a work queue. */
                if (!list_empty(&wusb_dev->cack_node))
                        queue_work(wusbd, &wusb_dev->devconnect_acked_work);
+               else
+                       wusb_dev_put(wusb_dev);
        }
 
        usb_hcd_giveback_urb(&wusbhc->usb_hcd, urb, status);