[PATCH] USB: Fix a bug in the UHCI dequeueing code

On Mon, 23 Feb 2004, Stephen Hemminger wrote:

> Great, the kernel with this patch ran successfully all weekend.  Looks like no
> more races in the unlink path.

Wonderful.  Thanks a lot for all your SMP testing, it's been a big help.


This patch corrects an error in the dequeueing code for UHCI.  Improper
locking caused it to hang in the oddball case where an URB was unlinked
even before it had been queued.

drivers/usb/host/uhci-hcd.c

@@ -1508,12 +1508,9 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, int mem_flags)
 		struct urb_priv *urbp = urb->hcpriv;
 
 		list_del_init(&urbp->urb_list);
-		spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
-		uhci_destroy_urb_priv (uhci, urb);
-
-		return ret;
-	}
-	ret = 0;
+		uhci_destroy_urb_priv(uhci, urb);
+	} else
+		ret = 0;
 
 out:
 	spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
@@ -1649,10 +1646,12 @@ static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
 {
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 	unsigned long flags;
-	struct urb_priv *urbp = urb->hcpriv;
+	struct urb_priv *urbp;
 
 	spin_lock_irqsave(&uhci->urb_list_lock, flags);
-
+	urbp = urb->hcpriv;
+	if (!urbp)			/* URB was never linked! */
+		goto done;
 	list_del_init(&urbp->urb_list);
 
 	uhci_unlink_generic(uhci, urb);
@@ -1665,6 +1664,7 @@ static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
 	list_add_tail(&urbp->urb_list, &uhci->urb_remove_list);
 
 	spin_unlock(&uhci->urb_remove_list_lock);
+done:
 	spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
 	return 0;
 }