From 5936ac7f93965931c508e1928d142076998ce65d Mon Sep 17 00:00:00 2001 From: David Vrabel Date: Wed, 8 Apr 2009 17:36:32 +0000 Subject: WUSB: fix oops when completing URBs for disconnected devices Fix an oops in wusbhc_giveback_urb() if the wusb device had disconnected while an urb was in progress. Also release the ref count obtained here. Signed-off-by: David Vrabel Signed-off-by: Greg Kroah-Hartman --- drivers/usb/wusbcore/devconnect.c | 2 ++ drivers/usb/wusbcore/wusbhc.c | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) (limited to 'drivers/usb/wusbcore') diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c index 63f200e4efb1..4ac4300a3f9a 100644 --- a/drivers/usb/wusbcore/devconnect.c +++ b/drivers/usb/wusbcore/devconnect.c @@ -267,6 +267,8 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work) mutex_lock(&wusbhc->mutex); wusbhc_devconnect_acked(wusbhc, wusb_dev); mutex_unlock(&wusbhc->mutex); + + wusb_dev_put(wusb_dev); } /* diff --git a/drivers/usb/wusbcore/wusbhc.c b/drivers/usb/wusbcore/wusbhc.c index 07c63a31c799..3638cc68529f 100644 --- a/drivers/usb/wusbcore/wusbhc.c +++ b/drivers/usb/wusbcore/wusbhc.c @@ -339,13 +339,15 @@ void wusbhc_giveback_urb(struct wusbhc *wusbhc, struct urb *urb, int status) { struct wusb_dev *wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev); - if (status == 0) { + if (status == 0 && wusb_dev) { wusb_dev->entry_ts = jiffies; - /* wusbhc_devconnect_acked() can't be called from from + /* wusbhc_devconnect_acked() can't be called from atomic context so defer it to a work queue. */ if (!list_empty(&wusb_dev->cack_node)) queue_work(wusbd, &wusb_dev->devconnect_acked_work); + else + wusb_dev_put(wusb_dev); } usb_hcd_giveback_urb(&wusbhc->usb_hcd, urb, status); -- cgit v1.2.1