USB: isp1760: urb_dequeue doesn't always find the urbs

commit 0afb20e00b5053170c85298fed842b32d20b4ea9 upstream.

The option driver (and presumably others) allocates several URBs when it
opens and tries to free them when it closes. The isp1760_urb_dequeue
function gets called, but the packet being dequeued is not necessarily at
the
front of one of the 32 queues. If not, the isp1760_urb_done function doesn't
get called for the URB and the process trying to free it hangs forever on a
wait_queue. This patch does two things. If the URB being dequeued has others
queued behind it, it re-queues them. And it searches the queues looking for
the URB being dequeued rather than just looking at the one at the front of
the queue.

[bigeasy@linutronix] whitespace fixes, reformating

Signed-off-by: Warren Free <wfree@ipmn.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index b899f1a59c262fd322b5b44caace1f8d6948b5ac..f14d74f12a5bb8e75f46e45e284bd38f2389fca8 100644 (file)
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1644,6 +1644,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
        u32 reg_base, or_reg, skip_reg;
        unsigned long flags;
        struct ptd ptd;
+       packet_enqueue *pe;
 
        switch (usb_pipetype(urb->pipe)) {
        case PIPE_ISOCHRONOUS:
@@ -1655,6 +1656,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                reg_base = INT_REGS_OFFSET;
                or_reg = HC_INT_IRQ_MASK_OR_REG;
                skip_reg = HC_INT_PTD_SKIPMAP_REG;
+               pe = enqueue_an_INT_packet;
                break;
 
        default:
@@ -1662,6 +1664,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                reg_base = ATL_REGS_OFFSET;
                or_reg = HC_ATL_IRQ_MASK_OR_REG;
                skip_reg = HC_ATL_PTD_SKIPMAP_REG;
+               pe =  enqueue_an_ATL_packet;
                break;
        }
 
@@ -1673,6 +1676,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                        u32 skip_map;
                        u32 or_map;
                        struct isp1760_qtd *qtd;
+                       struct isp1760_qh *qh = ints->qh;
 
                        skip_map = isp1760_readl(hcd->regs + skip_reg);
                        skip_map |= 1 << i;
@@ -1685,8 +1689,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                        priv_write_copy(priv, (u32 *)&ptd, hcd->regs + reg_base
                                        + i * sizeof(ptd), sizeof(ptd));
                        qtd = ints->qtd;
-
-                       clean_up_qtdlist(qtd);
+                       qtd = clean_up_qtdlist(qtd);
 
                        free_mem(priv, ints->payload);
 
@@ -1697,7 +1700,24 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                        ints->payload = 0;
 
                        isp1760_urb_done(priv, urb, status);
+                       if (qtd)
+                               pe(hcd, qh, qtd);
                        break;
+
+               } else if (ints->qtd) {
+                       struct isp1760_qtd *qtd, *prev_qtd = ints->qtd;
+
+                       for (qtd = ints->qtd->hw_next; qtd; qtd = qtd->hw_next) {
+                               if (qtd->urb == urb) {
+                                       prev_qtd->hw_next = clean_up_qtdlist(qtd);
+                                       isp1760_urb_done(priv, urb, status);
+                                       break;
+                               }
+                               prev_qtd = qtd;
+                       }
+                       /* we found the urb before the end of the list */
+                       if (qtd)
+                               break;
                }
                ints++;
        }