diff options
| author | David Brownell <dbrownell@users.sourceforge.net> | 2008-07-26 08:06:24 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-08-13 17:32:47 -0700 |
| commit | c728df70ab0dd59b8ccdc3c611ea88925e6697db (patch) | |
| tree | b9b56a813b061d14ac38cfb94e998d7437c5eb45 | |
| parent | 88d987d6db2a14b191f4eb21cc623dae31e28e9d (diff) | |
USB: fix USB boot crash, ecm_do_notify(), list_add corruption. prev->next should be next (ffff88003b8f82f8)
This fixes a BUG() turned up by Ingo via randconfig testing, where
CONFIG_LIST_DEBUG turned up list corruption. The corruption was
caused by the dummy_hcd (single-machine test harness for gadget and
HCD code) trashing the request queue when driven by the new CDC
composite gadget an I/O pattern that was previously uncommon.
Fix suggested by Alan Stern.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Tested-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/usb/gadget/dummy_hcd.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c index 21d1406af9e..7600a0c7875 100644 --- a/drivers/usb/gadget/dummy_hcd.c +++ b/drivers/usb/gadget/dummy_hcd.c @@ -542,13 +542,14 @@ dummy_queue (struct usb_ep *_ep, struct usb_request *_req, req->req.context = dum; req->req.complete = fifo_complete; + list_add_tail(&req->queue, &ep->queue); spin_unlock (&dum->lock); _req->actual = _req->length; _req->status = 0; _req->complete (_ep, _req); spin_lock (&dum->lock); - } - list_add_tail (&req->queue, &ep->queue); + } else + list_add_tail(&req->queue, &ep->queue); spin_unlock_irqrestore (&dum->lock, flags); /* real hardware would likely enable transfers here, in case |