[PATCH] USB: ohci unlink tweaks

Minor unlink tweaks, including a case where SMP could oops
if it were abused, as if from 'usbtest' or 'stir4200'.

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 1d9a689b06bba2168541c74b38b1e926abebc10a..44144a55308faec70bb24fec1a9b7698178a69cb 100644 (file)
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -233,7 +233,7 @@ static int ohci_urb_enqueue (
        spin_lock (&urb->lock);
        if (urb->status != -EINPROGRESS) {
                spin_unlock (&urb->lock);
-
+               urb->hcpriv = urb_priv;
                finish_urb (ohci, urb, 0);
                retval = 0;
                goto fail;

diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index b5f5f1f899b03fb2b7a865e93b0115cf0ce96f93..99b156ded8219e2ff4677560cd01c2b9720f1ca9 100644 (file)
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -1073,10 +1073,12 @@ dl_done_list (struct ohci_hcd *ohci, struct td *td, struct pt_regs *regs)
                        finish_urb (ohci, urb, regs);
 
                /* clean schedule:  unlink EDs that are no longer busy */
-               if (list_empty (&ed->td_list) && ed->state == ED_OPER)
-                       start_ed_unlink (ohci, ed);
+               if (list_empty (&ed->td_list)) {
+                       if (ed->state == ED_OPER)
+                               start_ed_unlink (ohci, ed);
+
                /* ... reenabling halted EDs only after fault cleanup */
-               else if ((ed->hwINFO & (ED_SKIP | ED_DEQUEUE)) == ED_SKIP) {
+               } else if ((ed->hwINFO & (ED_SKIP | ED_DEQUEUE)) == ED_SKIP) {
                        td = list_entry (ed->td_list.next, struct td, td_list);
                        if (!(td->hwINFO & TD_DONE)) {
                                ed->hwINFO &= ~ED_SKIP;