USB: fix double frees in error code paths of ipaq driver

[linux-2.6-omap-h63xx.git] / drivers / usb / image / microtek.c

diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
index 896cb2b71020d99f2c61a95721add5dc87e54602..768b2c11a2311d6efa8237e7868c4c642d8998dc 100644 (file)
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -128,7 +128,6 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
 #include <linux/usb.h>
 #include <linux/proc_fs.h>
 
@@ -190,7 +189,7 @@ static struct usb_driver mts_usb_driver = {
 #define MTS_DEBUG_INT() \
        do { MTS_DEBUG_GOT_HERE(); \
             MTS_DEBUG("transfer = 0x%x context = 0x%x\n",(int)transfer,(int)context ); \
-            MTS_DEBUG("status = 0x%x data-length = 0x%x sent = 0x%x\n",(int)transfer->status,(int)context->data_length, (int)transfer->actual_length ); \
+            MTS_DEBUG("status = 0x%x data-length = 0x%x sent = 0x%x\n",transfer->status,(int)context->data_length, (int)transfer->actual_length ); \
              mts_debug_dump(context->instance);\
           } while(0)
 #else
@@ -394,8 +393,6 @@ void mts_int_submit_urb (struct urb* transfer,
                      context
                );
 
-       transfer->status = 0;
-
        res = usb_submit_urb( transfer, GFP_ATOMIC );
        if ( unlikely(res) ) {
                MTS_INT_ERROR( "could not submit URB! Error was %d\n",(int)res );
@@ -445,12 +442,13 @@ static void mts_get_status( struct urb *transfer )
 static void mts_data_done( struct urb* transfer )
 /* Interrupt context! */
 {
+       int status = transfer->status;
        MTS_INT_INIT();
 
        if ( context->data_length != transfer->actual_length ) {
                context->srb->resid = context->data_length - transfer->actual_length;
-       } else if ( unlikely(transfer->status) ) {
-               context->srb->result = (transfer->status == -ENOENT ? DID_ABORT : DID_ERROR)<<16;
+       } else if ( unlikely(status) ) {
+               context->srb->result = (status == -ENOENT ? DID_ABORT : DID_ERROR)<<16;
        }
 
        mts_get_status(transfer);
@@ -462,10 +460,11 @@ static void mts_data_done( struct urb* transfer )
 static void mts_command_done( struct urb *transfer )
 /* Interrupt context! */
 {
+       int status = transfer->status;
        MTS_INT_INIT();
 
-       if ( unlikely(transfer->status) ) {
-               if (transfer->status == -ENOENT) {
+       if ( unlikely(status) ) {
+               if (status == -ENOENT) {
                        /* We are being killed */
                        MTS_DEBUG_GOT_HERE();
                        context->srb->result = DID_ABORT<<16;
@@ -503,12 +502,13 @@ static void mts_command_done( struct urb *transfer )
 static void mts_do_sg (struct urb* transfer)
 {
        struct scatterlist * sg;
+       int status = transfer->status;
        MTS_INT_INIT();
 
        MTS_DEBUG("Processing fragment %d of %d\n", context->fragment,context->srb->use_sg);
 
-       if (unlikely(transfer->status)) {
-                context->srb->result = (transfer->status == -ENOENT ? DID_ABORT : DID_ERROR)<<16;
+       if (unlikely(status)) {
+                context->srb->result = (status == -ENOENT ? DID_ABORT : DID_ERROR)<<16;
                mts_transfer_cleanup(transfer);
         }