xhci: don't use the same variable for stopped and halted rings current TD

Endpoints halted on errors, and endpoints stopped manually both used
the same ep->stopped_td to store the halted or stopped td. this causes
confusion and possible races.

There is no longer a need to use the ep->stopped_td variable to store
the halted TD. A halted endpoint is handled immediately and we can pass
it to the handling function directly.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 3 insertions, 3 deletions

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0ea7e12d4765..5be1bff9b4eb 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2912,10 +2912,11 @@ static void xhci_setup_input_ctx_for_quirk(struct xhci_hcd *xhci,
 }
 
 void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
-                struct usb_device *udev, unsigned int ep_index)
+                        unsigned int ep_index, struct xhci_td *td)
 {
         struct xhci_dequeue_state deq_state;
         struct xhci_virt_ep *ep;
+        struct usb_device *udev = td->urb->dev;
 
         xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
                         "Cleaning up stalled endpoint ring");
@@ -2924,8 +2925,7 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
          * or it will attempt to resend it on the next doorbell ring.
          */
         xhci_find_new_dequeue_state(xhci, udev->slot_id,
-                        ep_index, ep->stopped_stream, ep->stopped_td,
-                        &deq_state);
+                        ep_index, ep->stopped_stream, td, &deq_state);
 
         if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)
                 return;