usb: ehci: tegra: Fix Slab corruption error
Preetham Chandru [Thu, 9 Aug 2012 08:21:39 +0000 (13:21 +0530)]
Give ownership of the DMA buffer back to the processor first and
then free the buffer. Otherwise processor won't be able to
access the dma mapped buffers and this would lead to slab
corruption.
When the DMA buffer is freed without a call to dma_sync_single_for_cpu(),
the kernel won't be able to set the buffer as POISON FREE and when we
acquire this memory back again the kernel will start printing slab
corruption output as the memory is not set to POISON FREE

Bug 1017884
Bug 1018161
Reviewed-on: http://git-master/r/#change,122151
Signed-off-by: Preetham Chandru R <pchandru@nvidia.com>

Change-Id: I00d6cb185cd2314cccb56f968eb0a05288588c13
Reviewed-on: http://git-master/r/122390
Reviewed-by: Simone Willett <swillett@nvidia.com>
Tested-by: Simone Willett <swillett@nvidia.com>

drivers/usb/host/ehci-tegra.c

index 08f12be..af6fa87 100644 (file)
@@ -137,8 +137,6 @@ static int tegra_ehci_map_urb_for_dma(struct usb_hcd *hcd,
 static void tegra_ehci_unmap_urb_for_dma(struct usb_hcd *hcd,
        struct urb *urb)
 {
-       usb_hcd_unmap_urb_for_dma(hcd, urb);
-       free_align_buffer(urb);
 
        if (urb->transfer_dma) {
                enum dma_data_direction dir;
@@ -148,6 +146,9 @@ static void tegra_ehci_unmap_urb_for_dma(struct usb_hcd *hcd,
                                urb->transfer_dma, urb->transfer_buffer_length,
                                                                           DMA_FROM_DEVICE);
        }
+
+       usb_hcd_unmap_urb_for_dma(hcd, urb);
+       free_align_buffer(urb);
 }
 
 static irqreturn_t tegra_ehci_irq(struct usb_hcd *hcd)