aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Brownell <dbrownell@users.sourceforge.net>2008-07-26 08:06:24 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2008-08-13 17:32:47 -0700
commitc728df70ab0dd59b8ccdc3c611ea88925e6697db (patch)
treeb9b56a813b061d14ac38cfb94e998d7437c5eb45
parent88d987d6db2a14b191f4eb21cc623dae31e28e9d (diff)
USB: fix USB boot crash, ecm_do_notify(), list_add corruption. prev->next should be next (ffff88003b8f82f8)
This fixes a BUG() turned up by Ingo via randconfig testing, where CONFIG_LIST_DEBUG turned up list corruption. The corruption was caused by the dummy_hcd (single-machine test harness for gadget and HCD code) trashing the request queue when driven by the new CDC composite gadget an I/O pattern that was previously uncommon. Fix suggested by Alan Stern. Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Tested-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/usb/gadget/dummy_hcd.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 21d1406af9e..7600a0c7875 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -542,13 +542,14 @@ dummy_queue (struct usb_ep *_ep, struct usb_request *_req,
req->req.context = dum;
req->req.complete = fifo_complete;
+ list_add_tail(&req->queue, &ep->queue);
spin_unlock (&dum->lock);
_req->actual = _req->length;
_req->status = 0;
_req->complete (_ep, _req);
spin_lock (&dum->lock);
- }
- list_add_tail (&req->queue, &ep->queue);
+ } else
+ list_add_tail(&req->queue, &ep->queue);
spin_unlock_irqrestore (&dum->lock, flags);
/* real hardware would likely enable transfers here, in case