greybus: ignore a null cookie when canceling buffer
It's possible for an in-flight buffer to be recorded as sent *after*
a thread has begin the process of canceling it. In that case the
Greybus message cookie will be set to NULL, and that value can end
up getting passed to buffer_cancel(). Change buffer_cancel() so
it properly handles (ignores) a null cookie pointer.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
diff --git a/drivers/staging/greybus/es1-ap-usb.c b/drivers/staging/greybus/es1-ap-usb.c
index 2047843..1832d0f 100644
--- a/drivers/staging/greybus/es1-ap-usb.c
+++ b/drivers/staging/greybus/es1-ap-usb.c
@@ -245,16 +245,22 @@
return conceal_urb(urb);
}
+/*
+ * The cookie value supplied is the value that buffer_send()
+ * returned to its caller. It identifies the buffer that should be
+ * canceled. This function must also handle (which is to say,
+ * ignore) a null cookie value.
+ */
static void buffer_cancel(void *cookie)
{
- struct urb *urb = reveal_urb(cookie);
/*
* We really should be defensive and track all outstanding
* (sent) buffers rather than trusting the cookie provided
* is valid. For the time being, this will do.
*/
- usb_kill_urb(urb);
+ if (cookie)
+ usb_kill_urb(reveal_urb(cookie));
}
static struct greybus_host_driver es1_driver = {