From 16cec61570f4afdccdd692eec254dd13256b287e Mon Sep 17 00:00:00 2001
From: Pavel Machek <pavel@suse.cz>
Date: Fri, 2 May 2008 16:45:10 -0700
Subject: [PATCH] --- yaml --- r: 95898 b: refs/heads/master c:
 026672d0997c911c9bef9aabe862884fc0add106 h: refs/heads/master v: v3

---
 [refs]                            |  2 +-
 trunk/drivers/bluetooth/hci_usb.h | 21 +++++++++++++--------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/[refs] b/[refs]
index 9501dc7101b1..0a1fcb954e99 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 84994e16f25dabe234be4fc2d323ec9db95b87cb
+refs/heads/master: 026672d0997c911c9bef9aabe862884fc0add106
diff --git a/trunk/drivers/bluetooth/hci_usb.h b/trunk/drivers/bluetooth/hci_usb.h
index 414080a4e8ff..1790cc8e431e 100644
--- a/trunk/drivers/bluetooth/hci_usb.h
+++ b/trunk/drivers/bluetooth/hci_usb.h
@@ -70,7 +70,8 @@ static inline void _urb_queue_head(struct _urb_queue *q, struct _urb *_urb)
 {
 	unsigned long flags;
 	spin_lock_irqsave(&q->lock, flags);
-	list_add(&_urb->list, &q->head); _urb->queue = q;
+	/* _urb_unlink needs to know which spinlock to use, thus mb(). */
+	_urb->queue = q; mb(); list_add(&_urb->list, &q->head);
 	spin_unlock_irqrestore(&q->lock, flags);
 }
 
@@ -78,19 +79,23 @@ static inline void _urb_queue_tail(struct _urb_queue *q, struct _urb *_urb)
 {
 	unsigned long flags;
 	spin_lock_irqsave(&q->lock, flags);
-	list_add_tail(&_urb->list, &q->head); _urb->queue = q;
+	/* _urb_unlink needs to know which spinlock to use, thus mb(). */
+	_urb->queue = q; mb(); list_add_tail(&_urb->list, &q->head);
 	spin_unlock_irqrestore(&q->lock, flags);
 }
 
 static inline void _urb_unlink(struct _urb *_urb)
 {
-	struct _urb_queue *q = _urb->queue;
+	struct _urb_queue *q;
 	unsigned long flags;
-	if (q) {
-		spin_lock_irqsave(&q->lock, flags);
-		list_del(&_urb->list); _urb->queue = NULL;
-		spin_unlock_irqrestore(&q->lock, flags);
-	}
+
+	mb();
+	q = _urb->queue;
+	/* If q is NULL, it will die at easy-to-debug NULL pointer dereference.
+	   No need to BUG(). */
+	spin_lock_irqsave(&q->lock, flags);
+	list_del(&_urb->list); _urb->queue = NULL;
+	spin_unlock_irqrestore(&q->lock, flags);
 }
 
 struct hci_usb {