[PATCH] USB: ipaq.c bugfixes

This patch fixes several problems in the ipaq.c driver with connecting
and disconnecting pocketpc devices:

* The read urb stayed active if the connect failed, causing nullpointer
  dereferences later on.

* If a write failed, the driver continued as if nothing happened. Now it
  handles that case the same way as other usb serial devices (fix by
  Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>)

Signed-off-by: Frank Gevaerts <frank.gevaerts@fks.be>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 6 insertions, 5 deletions

diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index dbcfe172a5cc..c021905f0637 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -651,11 +651,6 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp)
                       usb_rcvbulkpipe(serial->dev, port->bulk_in_endpointAddress),
                       port->read_urb->transfer_buffer, port->read_urb->transfer_buffer_length,
                       ipaq_read_bulk_callback, port);
-        result = usb_submit_urb(port->read_urb, GFP_KERNEL);
-        if (result) {
-                err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
-                goto error;
-        }
 
         /*
          * Send out control message observed in win98 sniffs. Not sure what
@@ -670,6 +665,11 @@ static int ipaq_open(struct usb_serial_port *port, struct file *filp)
                                 usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
                                 0x1, 0, NULL, 0, 100);
                 if (result == 0) {
+                        result = usb_submit_urb(port->read_urb, GFP_KERNEL);
+                        if (result) {
+                                err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
+                                goto error;
+                        }
                         return 0;
                 }
         }
@@ -854,6 +854,7 @@ static void ipaq_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
         
         if (urb->status) {
                 dbg("%s - nonzero write bulk status received: %d", __FUNCTION__, urb->status);
+                return;
         }
 
         spin_lock_irqsave(&write_list_lock, flags);