usb: musb: gadget: fix list_head usage

commit ad1adb89a0d9410345d573b6995a1fa9f9b7c74a
(usb: musb: gadget: do not poke with gadget's list_head)
fixed a bug in musb where it was corrupting the list_head
which is supposed to be used by gadget drivers. While
doing that, I forgot to fix the usage in musb_gadget_dequeue()
method. Fix that.

Reported-by: Pavol Kurina <pavol.kurina@emsys.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index da8c93bfb6fbcf292f145ca9536279f8943c8f23..2a3aee4e108f6afa883a4cc91632a7ca7657de74 100644 (file)
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1274,7 +1274,8 @@ cleanup:
 static int musb_gadget_dequeue(struct usb_ep *ep, struct usb_request *request)
 {
        struct musb_ep          *musb_ep = to_musb_ep(ep);
-       struct usb_request      *r;
+       struct musb_request     *req = to_musb_request(request);
+       struct musb_request     *r;
        unsigned long           flags;
        int                     status = 0;
        struct musb             *musb = musb_ep->musb;
@@ -1285,10 +1286,10 @@ static int musb_gadget_dequeue(struct usb_ep *ep, struct usb_request *request)
        spin_lock_irqsave(&musb->lock, flags);
 
        list_for_each_entry(r, &musb_ep->req_list, list) {
-               if (r == request)
+               if (r == req)
                        break;
        }
-       if (r != request) {
+       if (r != req) {
                DBG(3, "request %p not queued to %s\n", request, ep->name);
                status = -EINVAL;
                goto done;