summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorXuelin Shi <xuelin.shi@freescale.com>2014-05-21 14:02:37 -0700
committerDan Williams <dan.j.williams@intel.com>2014-05-21 14:02:37 -0700
commitc1f43dd9c20d85e66c4d77e284f64ac114abe3f8 (patch)
treeee4ff99c2742b037071435d9dc0423eb3650da51 /drivers
parent5a9a55bf9157d3490b0c8c4c81d4708602c26e07 (diff)
dmaengine: fix dmaengine_unmap failure
The count which is used to get_unmap_data maybe not the same as the count computed in dmaengine_unmap which causes to free data in a wrong pool. This patch fixes this issue by keeping the map count with unmap_data structure and use this count to get the pool. Cc: <stable@vger.kernel.org> Signed-off-by: Xuelin Shi <xuelin.shi@freescale.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/dma/dmaengine.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index a886713937fd..d5d30ed863ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1009,6 +1009,7 @@ static void dmaengine_unmap(struct kref *kref)
dma_unmap_page(dev, unmap->addr[i], unmap->len,
DMA_BIDIRECTIONAL);
}
+ cnt = unmap->map_cnt;
mempool_free(unmap, __get_unmap_pool(cnt)->pool);
}
@@ -1074,6 +1075,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
memset(unmap, 0, sizeof(*unmap));
kref_init(&unmap->kref);
unmap->dev = dev;
+ unmap->map_cnt = nr;
return unmap;
}