summaryrefslogtreecommitdiff
path: root/drivers/usb/host/xhci-ring.c
diff options
context:
space:
mode:
authorArnd Bergmann <arnd@arndb.de>2016-06-30 14:26:17 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-07-01 08:59:44 -0700
commitf76a28a69a103b8789d2430a193af558f4c85364 (patch)
tree3f95481073f2b81ba9ab6b2612871af18a706383 /drivers/usb/host/xhci-ring.c
parent463c4683cfee44b82239dd88bcaea0cb29f5e041 (diff)
xhci: free the correct ring
gcc warns about what first looks like a reference to an uninitialized variable: drivers/usb/host/xhci-ring.c: In function 'handle_cmd_completion': drivers/usb/host/xhci-ring.c:753:4: error: 'ep_ring' may be used uninitialized in this function [-Werror=maybe-uninitialized] xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci-ring.c:647:20: note: 'ep_ring' was declared here struct xhci_ring *ep_ring; ^~~~~~~ It's clear to see that the list_empty() check means it can never be uninitialized, however it still looks wrong: When ep->cancelled_td_list contains more than one entry, the ep_ring variable will point to the ring that was retrieved from the last urb, and we have to look it up again in the second loop instead, which fixes the behavior and gets rid of the warning too. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer") Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/host/xhci-ring.c')
-rw-r--r--drivers/usb/host/xhci-ring.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 21e1dd62ebf8..918e0c739b79 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -749,6 +749,7 @@ remove_finished_td:
/* Doesn't matter what we pass for status, since the core will
* just overwrite it (because the URB has been unlinked).
*/
+ ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb);
if (ep_ring && cur_td->bounce_seg)
xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td);
xhci_giveback_urb_in_irq(xhci, cur_td, 0);