From patchwork Thu Jun 30 12:26:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 102065 Delivered-To: patch@linaro.org Received: by 10.140.28.4 with SMTP id 4csp365213qgy; Thu, 30 Jun 2016 05:24:22 -0700 (PDT) X-Received: by 10.66.25.8 with SMTP id y8mr20896750paf.106.1467289461814; Thu, 30 Jun 2016 05:24:21 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id wk4si4346487pab.65.2016.06.30.05.24.21; Thu, 30 Jun 2016 05:24:21 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752160AbcF3MYU (ORCPT + 30 others); Thu, 30 Jun 2016 08:24:20 -0400 Received: from mout.kundenserver.de ([212.227.126.134]:65407 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751975AbcF3MYQ (ORCPT ); Thu, 30 Jun 2016 08:24:16 -0400 Received: from wuerfel.lan. ([78.42.132.4]) by mrelayeu.kundenserver.de (mreue003) with ESMTPA (Nemesis) id 0Lv6gg-1bSBTv25is-010NTp; Thu, 30 Jun 2016 14:23:53 +0200 From: Arnd Bergmann To: Mathias Nyman , Greg Kroah-Hartman Cc: Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] xhci: free the correct ring Date: Thu, 30 Jun 2016 14:26:17 +0200 Message-Id: <20160630122639.4048493-1-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 X-Provags-ID: V03:K0:O9eOguyM0zyif/bgDWhhZym0KlIEGooE6/uaAR++vZ/bmCL3xAo p+t7pKalWc2D07cF9T7N0qLMWwlFU/o6TX4cDhQKQvbNviyqVPlz+4TJeIZWtQqr/9kscn/ EFZgP0eAFiQ8tx5aStgLk5/wavS/oekJPpU3IvVkgiNrJCoSEOCjMt/QBLJeGB2RVacCFfl WuzDB6UQ89KJTpZxO4dMw== X-UI-Out-Filterresults: notjunk:1; V01:K0:9oCOAOeiYkQ=:XBXeBN3YTwo8T8g3XNON8T 9lMLi+YLxUo3GLipFoH7UvhL27ZBNfoNRHDrySzLF1sTTdWwpjINr5BysweKAvP0+4ckSj5G+ +evNX0CN7hY91UIYrePge4aQKJW+6ugFKHqh+QwM/4Tx8+wLnrx5QMxgXTCCLTtyaVbDaQXuc OC9Rb5mVOYUi2/WqjFWbjR0hz+VIoGCeHXK5pMAJaijpoHCBHzLFrqHHH99UM+COx8lAuCIQC 5i1pwV0v4EnyjK0+LwGG9yu/sCr5YmDF106AG4tVhaZo8fFjK5zW6a1bg4VDZhVe+7/YltylK oYG0oeO6DC9k37WYTqE1CpBJAMcFgjOG271yXbDXfwuU7vEuJBcebEd6AfluhOz9Oui4V6qMV miReZxHFbuSKAETa1kYkLa8wsXcALCa3zoRM9Q/HLYEnVjyt8L4lHY9IJego0Ye+6GuolnV74 Z+/KyMaEhoJ8k8xgTIQtBizfm5CYB37d/i75fRPOUklzGK6kznJU55tRE7o+5Q7P/Xk4lKCVC X3eaaNv3f2QlaGgfsrazWN7H8W1buKSC1k2E7VUloFk2HxcM4OmDt9+AU+gmBzUzpBiOefMxN UoO6i0vNs5ntV5s5SjKYgi/Fd0joZV9jaBW46DoPi/T4XEMEsutfhxlzyJyD4dxbrA5QbMecY fD/fnHYF1PjNavWB1hJj7WL+tYt71wGH8O0r7XkwU4jqjEafdDfcHPb0lnlb0D0qVjJw= Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org gcc warns about what first looks like a reference to an uninitialized variable: drivers/usb/host/xhci-ring.c: In function 'handle_cmd_completion': drivers/usb/host/xhci-ring.c:753:4: error: 'ep_ring' may be used uninitialized in this function [-Werror=maybe-uninitialized] xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci-ring.c:647:20: note: 'ep_ring' was declared here struct xhci_ring *ep_ring; ^~~~~~~ It's clear to see that the list_empty() check means it can never be uninitialized, however it still looks wrong: When ep->cancelled_td_list contains more than one entry, the ep_ring variable will point to the ring that was retrieved from the last urb, and we have to look it up again in the second loop instead, which fixes the behavior and gets rid of the warning too. Signed-off-by: Arnd Bergmann Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer") --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) -- 2.9.0 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 21e1dd62ebf8..918e0c739b79 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -749,6 +749,7 @@ remove_finished_td: /* Doesn't matter what we pass for status, since the core will * just overwrite it (because the URB has been unlinked). */ + ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb); if (ep_ring && cur_td->bounce_seg) xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td); xhci_giveback_urb_in_irq(xhci, cur_td, 0);