History

i2c: sh_mobile: fix leak when using DMA bounce buffer

We only freed the bounce buffer after successful DMA, missing the cases where DMA setup may have gone wrong. Use a better location which always gets called after each message and use 'stop_after_dma' as a flag for a successful transfer.

Wolfram Sang committed 8 years ago

Commit cebc07d1 parent 531db501 file · +4 −2Browse files

Unified · Split

drivers/i2c/busses/i2c-sh_mobile.c+4−2
@@ -507,8 +507,6 @@ static void sh_mobile_i2c_dma_callback(void *data) · 506 unmodified lines
507 pd->pos = pd->msg->len;507 pd->pos = pd->msg->len;
508 pd->stop_after_dma = true;508 pd->stop_after_dma = true;
509 509
510 i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, true);
511
512 iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);510 iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
513}511}
514 512
@@ -706,6 +704,10 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter, · 191 unmodified lines
706 timeout = wait_event_timeout(pd->wait,704 timeout = wait_event_timeout(pd->wait,
707 pd->sr & (ICSR_TACK | SW_DONE),705 pd->sr & (ICSR_TACK | SW_DONE),
708 adapter->timeout);706 adapter->timeout);
707
708 /* 'stop_after_dma' tells if DMA transfer was complete */
709 i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, pd->stop_after_dma);
710
709 if (!timeout) {711 if (!timeout) {
710 dev_err(pd->dev, "Transfer request timed out\n");712 dev_err(pd->dev, "Transfer request timed out\n");
711 if (pd->dma_direction != DMA_NONE)713 if (pd->dma_direction != DMA_NONE)