gadgetfs: Fix leak on error in aio_read()

[pandora-kernel.git] / drivers / usb / gadget / fsl_udc_core.c

diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index dd28ef3..01de16e 100644 (file)
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -736,6 +736,8 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
                lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
                lastreq->tail->next_td_ptr =
                        cpu_to_hc32(req->head->td_dma & DTD_ADDR_MASK);
+               /* Ensure dTD's next dtd pointer to be updated */
+               wmb();
                /* Read prime bit, if 1 goto done */
                if (fsl_readl(&dr_regs->endpointprime) & bitmask)
                        return;
@@ -768,7 +770,7 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
  * @is_last: return flag if it is the last dTD of the request
  * return: pointer to the built dTD */
 static struct ep_td_struct *fsl_build_dtd(struct fsl_req *req, unsigned *length,
-               dma_addr_t *dma, int *is_last)
+               dma_addr_t *dma, int *is_last, gfp_t gfp_flags)
 {
        u32 swap_temp;
        struct ep_td_struct *dtd;
@@ -777,7 +779,7 @@ static struct ep_td_struct *fsl_build_dtd(struct fsl_req *req, unsigned *length,
        *length = min(req->req.length - req->req.actual,
                        (unsigned)EP_MAX_LENGTH_TRANSFER);
 
-       dtd = dma_pool_alloc(udc_controller->td_pool, GFP_KERNEL, dma);
+       dtd = dma_pool_alloc(udc_controller->td_pool, gfp_flags, dma);
        if (dtd == NULL)
                return dtd;
 
@@ -827,7 +829,7 @@ static struct ep_td_struct *fsl_build_dtd(struct fsl_req *req, unsigned *length,
 }
 
 /* Generate dtd chain for a request */
-static int fsl_req_to_dtd(struct fsl_req *req)
+static int fsl_req_to_dtd(struct fsl_req *req, gfp_t gfp_flags)
 {
        unsigned        count;
        int             is_last;
@@ -836,7 +838,7 @@ static int fsl_req_to_dtd(struct fsl_req *req)
        dma_addr_t dma;
 
        do {
-               dtd = fsl_build_dtd(req, &count, &dma, &is_last);
+               dtd = fsl_build_dtd(req, &count, &dma, &is_last, gfp_flags);
                if (dtd == NULL)
                        return -ENOMEM;
 
@@ -910,13 +912,11 @@ fsl_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
        req->req.actual = 0;
        req->dtd_count = 0;
 
-       spin_lock_irqsave(&udc->lock, flags);
-
        /* build dtds and push them to device queue */
-       if (!fsl_req_to_dtd(req)) {
+       if (!fsl_req_to_dtd(req, gfp_flags)) {
+               spin_lock_irqsave(&udc->lock, flags);
                fsl_queue_td(ep, req);
        } else {
-               spin_unlock_irqrestore(&udc->lock, flags);
                return -ENOMEM;
        }
 
@@ -1295,7 +1295,7 @@ static int ep0_prime_status(struct fsl_udc *udc, int direction)
                        ep_is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
        req->mapped = 1;
 
-       if (fsl_req_to_dtd(req) == 0)
+       if (fsl_req_to_dtd(req, GFP_ATOMIC) == 0)
                fsl_queue_td(ep, req);
        else
                return -ENOMEM;
@@ -1379,7 +1379,7 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value,
        req->mapped = 1;
 
        /* prime the data phase */
-       if ((fsl_req_to_dtd(req) == 0))
+       if ((fsl_req_to_dtd(req, GFP_ATOMIC) == 0))
                fsl_queue_td(ep, req);
        else                    /* no mem */
                goto stall;