Commit f34541d7 authored by Alex Elder's avatar Alex Elder Committed by Greg Kroah-Hartman
Browse files

greybus: ignore a null cookie when canceling buffer 



It's possible for an in-flight buffer to be recorded as sent *after*
a thread has begin the process of canceling it.  In that case the
Greybus message cookie will be set to NULL, and that value can end
up getting passed to buffer_cancel().  Change buffer_cancel() so
it properly handles (ignores) a null cookie pointer.

Signed-off-by: default avatarAlex Elder <elder@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <greg@kroah.com>
parent 894cbc31

drivers/staging/greybus/es1-ap-usb.c

+8 −2
Original line number Diff line number Diff line
@@ -245,16 +245,22 @@ static void *buffer_send(struct greybus_host_device *hd, u16 dest_cport_id, 
	return conceal_urb(urb);

}



/*

 * The cookie value supplied is the value that buffer_send()

 * returned to its caller.  It identifies the buffer that should be

 * canceled.  This function must also handle (which is to say,

 * ignore) a null cookie value.

 */

static void buffer_cancel(void *cookie)

{

	struct urb *urb = reveal_urb(cookie);



	/*

	 * We really should be defensive and track all outstanding

	 * (sent) buffers rather than trusting the cookie provided

	 * is valid.  For the time being, this will do.

	 */

	usb_kill_urb(urb);

	if (cookie)

		usb_kill_urb(reveal_urb(cookie));

}



static struct greybus_host_driver es1_driver = {