greybus: ignore a null cookie when canceling buffer

It's possible for an in-flight buffer to be recorded as sent *after*
a thread has begin the process of canceling it.  In that case the
Greybus message cookie will be set to NULL, and that value can end
up getting passed to buffer_cancel().  Change buffer_cancel() so
it properly handles (ignores) a null cookie pointer.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

drivers/staging/greybus/es1-ap-usb.c

@@ -245,16 +245,22 @@ static void *buffer_send(struct greybus_host_device *hd, u16 dest_cport_id,
 	return conceal_urb(urb);
 }
 
+/*
+ * The cookie value supplied is the value that buffer_send()
+ * returned to its caller.  It identifies the buffer that should be
+ * canceled.  This function must also handle (which is to say,
+ * ignore) a null cookie value.
+ */
 static void buffer_cancel(void *cookie)
 {
-	struct urb *urb = reveal_urb(cookie);
 
 	/*
 	 * We really should be defensive and track all outstanding
 	 * (sent) buffers rather than trusting the cookie provided
 	 * is valid.  For the time being, this will do.
 	 */
-	usb_kill_urb(urb);
+	if (cookie)
+		usb_kill_urb(reveal_urb(cookie));
 }
 
 static struct greybus_host_driver es1_driver = {