Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6: (39 commits)
  USB: at91-ohci, handle extra at91sam9261 ahb clock
  USB: another id for cp2101 driver
  USB: ueagle-atm.c needs sched.h
  USB: at91_udc, shrink runtime footprint
  usbnet: add missing Kconfig for KC2190 cables
  usbnet: init fault (oops) cleanup, whitespace fixes
  usbnet: recognize SiteCom CN-124
  usb: Remove Airprime device from option.c
  USB: change __init to __devinit for isp116x_probe
  USB: ps3: don't call ps3_system_bus_driver_register on other platforms
  USB: hid-core.c: Removes GTCO CalComp Interwrite IPanel PIDs from blacklist
  USB: kernel-doc fixes
  USB: quirky device for cdc-acm
  USB: cdc-acm: fix incorrect throtteling, make set_control optional
  USB: unconfigure devices which have config 0
  USB: make usb_iso_packet_descriptor.status signed
  USB: fix g_serial small error
  USB: use __u32 rather than u32 in userspace ioctls in usbdevice_fs.h
  USB Storage: US_FL_IGNORE_RESIDUE needed for Aiptek MP3 Player
  USB: Fix misspelled "USBNET_MII" kernel config option.
  ...

1 files changed, 8 insertions, 27 deletions

diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 0af42e32fa0a..18816bf96a4d 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -58,11 +58,6 @@ static void airprime_read_bulk_callback(struct urb *urb)
         if (urb->status) {
                 dbg("%s - nonzero read bulk status received: %d",
                     __FUNCTION__, urb->status);
-                /* something happened, so free up the memory for this urb */
-                if (urb->transfer_buffer) {
-                        kfree (urb->transfer_buffer);
-                        urb->transfer_buffer = NULL;
-                }
                 return;
         }
         usb_serial_debug_data(debug, &port->dev, __FUNCTION__, urb->actual_length, data);
@@ -146,6 +141,8 @@ static int airprime_open(struct usb_serial_port *port, struct file *filp)
                                   airprime_read_bulk_callback, port);
                 result = usb_submit_urb(urb, GFP_KERNEL);
                 if (result) {
+                        usb_free_urb(urb);
+                        kfree(buffer);
                         dev_err(&port->dev,
                                 "%s - failed submitting read urb %d for port %d, error %d\n",
                                 __FUNCTION__, i, port->number, result);
@@ -160,27 +157,12 @@ static int airprime_open(struct usb_serial_port *port, struct file *filp)
         /* some error happened, cancel any submitted urbs and clean up anything that
            got allocated successfully */
 
-        for ( ; i >= 0; --i) {
+        while (i-- != 0) {
                 urb = priv->read_urbp[i];
-                if (urb) {
-                        /* This urb was submitted successfully. So we have to
-                           cancel it.
-                           Unlinking the urb will invoke read_bulk_callback()
-                           with an error status, so its transfer buffer will
-                           be freed there */
-                        if (usb_unlink_urb (urb) != -EINPROGRESS) {
-                                /* comments in drivers/usb/core/urb.c say this
-                                   can only happen if the urb was never submitted,
-                                   or has completed already.
-                                   Either way we may have to free the transfer
-                                   buffer here. */
-                                if (urb->transfer_buffer) {
-                                        kfree (urb->transfer_buffer);
-                                        urb->transfer_buffer = NULL;
-                                }
-                        }
-                        usb_free_urb (urb);
-                }
+                buffer = urb->transfer_buffer;
+                usb_kill_urb (urb);
+                usb_free_urb (urb);
+                kfree (buffer);
         }
 
  out:
@@ -194,10 +176,9 @@ static void airprime_close(struct usb_serial_port *port, struct file * filp)
 
         dbg("%s - port %d", __FUNCTION__, port->number);
 
-        /* killing the urb will invoke read_bulk_callback() with an error status,
-           so the transfer buffer will be freed there */
         for (i = 0; i < NUM_READ_URBS; ++i) {
                 usb_kill_urb (priv->read_urbp[i]);
+                kfree (priv->read_urbp[i]->transfer_buffer);
                 usb_free_urb (priv->read_urbp[i]);
         }