greybus: ignore a null cookie when canceling buffer

It's possible for an in-flight buffer to be recorded as sent *after*
a thread has begin the process of canceling it.  In that case the
Greybus message cookie will be set to NULL, and that value can end
up getting passed to buffer_cancel().  Change buffer_cancel() so
it properly handles (ignores) a null cookie pointer.

Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

diff --git a/drivers/staging/greybus/es1-ap-usb.c b/drivers/staging/greybus/es1-ap-usb.c
index 2047843297162af941188d3b6abd7ea3b624fc94..1832d0f41b8a73afaa6ab2510d387a33f8ec196f 100644 (file)
--- a/drivers/staging/greybus/es1-ap-usb.c
+++ b/drivers/staging/greybus/es1-ap-usb.c
@@ -245,16 +245,22 @@ static void *buffer_send(struct greybus_host_device *hd, u16 dest_cport_id,
        return conceal_urb(urb);
 }
 
+/*
+ * The cookie value supplied is the value that buffer_send()
+ * returned to its caller.  It identifies the buffer that should be
+ * canceled.  This function must also handle (which is to say,
+ * ignore) a null cookie value.
+ */
 static void buffer_cancel(void *cookie)
 {
-       struct urb *urb = reveal_urb(cookie);
 
        /*
         * We really should be defensive and track all outstanding
         * (sent) buffers rather than trusting the cookie provided
         * is valid.  For the time being, this will do.
         */
-       usb_kill_urb(urb);
+       if (cookie)
+               usb_kill_urb(reveal_urb(cookie));
 }
 
 static struct greybus_host_driver es1_driver = {