Commit c728df70 authored by David Brownell's avatar David Brownell Committed by Greg Kroah-Hartman

USB: fix USB boot crash, ecm_do_notify(), list_add corruption. prev->next...

USB: fix USB boot crash, ecm_do_notify(), list_add corruption. prev->next should be next (ffff88003b8f82f8)

This fixes a BUG() turned up by Ingo via randconfig testing, where
CONFIG_LIST_DEBUG turned up list corruption.  The corruption was
caused by the dummy_hcd (single-machine test harness for gadget and
HCD code) trashing the request queue when driven by the new CDC
composite gadget an I/O pattern that was previously uncommon.
Fix suggested by Alan Stern.
Signed-off-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Tested-by: default avatarIngo Molnar <mingo@elte.hu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 88d987d6
...@@ -542,13 +542,14 @@ dummy_queue (struct usb_ep *_ep, struct usb_request *_req, ...@@ -542,13 +542,14 @@ dummy_queue (struct usb_ep *_ep, struct usb_request *_req,
req->req.context = dum; req->req.context = dum;
req->req.complete = fifo_complete; req->req.complete = fifo_complete;
list_add_tail(&req->queue, &ep->queue);
spin_unlock (&dum->lock); spin_unlock (&dum->lock);
_req->actual = _req->length; _req->actual = _req->length;
_req->status = 0; _req->status = 0;
_req->complete (_ep, _req); _req->complete (_ep, _req);
spin_lock (&dum->lock); spin_lock (&dum->lock);
} } else
list_add_tail (&req->queue, &ep->queue); list_add_tail(&req->queue, &ep->queue);
spin_unlock_irqrestore (&dum->lock, flags); spin_unlock_irqrestore (&dum->lock, flags);
/* real hardware would likely enable transfers here, in case /* real hardware would likely enable transfers here, in case
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment