From: Xuelin Shi <xuelin.shi@xxxxxxxxxxxxx>
The count which is used to get_unmap_data maybe not the same as the
count computed in dmaengine_unmap which causes to free data in a
wrong pool.
This patch fixes this issue by keeping the pool in unmap_data
structure.
Signed-off-by: Xuelin Shi <xuelin.shi@xxxxxxxxxxxxx>
---
drivers/dma/dmaengine.c | 7 +++++--
include/linux/dmaengine.h | 1 +
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index ed610b4..2977eee 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1014,7 +1014,7 @@ static void dmaengine_unmap(struct kref *kref)
dma_unmap_page(dev, unmap->addr[i], unmap->len,
DMA_BIDIRECTIONAL);
}
- mempool_free(unmap, __get_unmap_pool(cnt)->pool);
+ mempool_free(unmap, unmap->unmap_pool->pool);
}
void dmaengine_unmap_put(struct dmaengine_unmap_data *unmap)
@@ -1071,14 +1071,17 @@ struct dmaengine_unmap_data *
dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
{
struct dmaengine_unmap_data *unmap;
+ struct dmaengine_unmap_pool *unmap_pool;
- unmap = mempool_alloc(__get_unmap_pool(nr)->pool, flags);
+ unmap_pool = __get_unmap_pool(nr);
+ unmap = mempool_alloc(unmap_pool->pool, flags);
if (!unmap)
return NULL;
memset(unmap, 0, sizeof(*unmap));
kref_init(&unmap->kref);
unmap->dev = dev;
+ unmap->unmap_pool = unmap_pool;
return unmap;
}
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index c5c92d5..6a25635 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -439,6 +439,7 @@ struct dmaengine_unmap_data {
struct device *dev;
struct kref kref;
size_t len;
+ struct dmaengine_unmap_pool *unmap_pool;
dma_addr_t addr[0];
};
--
1.8.3.2
--
To unsubscribe from this list: send the line "unsubscribe dmaengine" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
