dmaengine: fix dmaengine_unmap failure (c1f43dd9) · Commits · 戴 / test

The count which is used to get_unmap_data maybe not the same as the count computed in dmaengine_unmap which causes to free data in a wrong pool. This patch fixes this issue by keeping the map count with unmap_data structure and use this count to get the pool. Cc: <stable@vger.kernel.org> Signed-off-by:

Xuelin Shi <xuelin.shi@freescale.com> Signed-off-by:

Dan Williams <dan.j.williams@intel.com>

drivers/dma/dmaengine.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1009,6 +1009,7 @@ static void dmaengine_unmap(struct kref *kref)
		dma_unmap_page(dev, unmap->addr[i], unmap->len,
		DMA_BIDIRECTIONAL);
		}
		cnt = unmap->map_cnt;
		mempool_free(unmap, __get_unmap_pool(cnt)->pool);
		}

		@@ -1074,6 +1075,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
		memset(unmap, 0, sizeof(*unmap));
		kref_init(&unmap->kref);
		unmap->dev = dev;
		unmap->map_cnt = nr;

		return unmap;
		}

include/linux/dmaengine.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -429,6 +429,7 @@ typedef bool (dma_filter_fn)(struct dma_chan chan, void *filter_param);
		typedef void (dma_async_tx_callback)(void dma_async_param);

		struct dmaengine_unmap_data {
		u8 map_cnt;
		u8 to_cnt;
		u8 from_cnt;
		u8 bidi_cnt;

Admin message