1 files changed, 36 insertions, 16 deletions

diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
index ccf0e4cf108..03ae8a77c47 100644
--- a/drivers/firewire/fw-transaction.c
+++ b/drivers/firewire/fw-transaction.c
@@ -20,6 +20,7 @@
 
 #include <linux/completion.h>
 #include <linux/kernel.h>
+#include <linux/kref.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -297,37 +298,55 @@ EXPORT_SYMBOL(fw_send_request);
 struct fw_phy_packet {
         struct fw_packet packet;
         struct completion done;
+        struct kref kref;
 };
 
-static void
-transmit_phy_packet_callback(struct fw_packet *packet,
-                             struct fw_card *card, int status)
+static void phy_packet_release(struct kref *kref)
+{
+        struct fw_phy_packet *p =
+                        container_of(kref, struct fw_phy_packet, kref);
+        kfree(p);
+}
+
+static void transmit_phy_packet_callback(struct fw_packet *packet,
+                                         struct fw_card *card, int status)
 {
         struct fw_phy_packet *p =
                         container_of(packet, struct fw_phy_packet, packet);
 
         complete(&p->done);
+        kref_put(&p->kref, phy_packet_release);
 }
 
 void fw_send_phy_config(struct fw_card *card,
                         int node_id, int generation, int gap_count)
 {
-        struct fw_phy_packet p;
+        struct fw_phy_packet *p;
+        long timeout = DIV_ROUND_UP(HZ, 10);
         u32 data = PHY_IDENTIFIER(PHY_PACKET_CONFIG) |
                    PHY_CONFIG_ROOT_ID(node_id) |
                    PHY_CONFIG_GAP_COUNT(gap_count);
 
-        p.packet.header[0] = data;
-        p.packet.header[1] = ~data;
-        p.packet.header_length = 8;
-        p.packet.payload_length = 0;
-        p.packet.speed = SCODE_100;
-        p.packet.generation = generation;
-        p.packet.callback = transmit_phy_packet_callback;
-        init_completion(&p.done);
-
-        card->driver->send_request(card, &p.packet);
-        wait_for_completion(&p.done);
+        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        if (p == NULL)
+                return;
+
+        p->packet.header[0] = data;
+        p->packet.header[1] = ~data;
+        p->packet.header_length = 8;
+        p->packet.payload_length = 0;
+        p->packet.speed = SCODE_100;
+        p->packet.generation = generation;
+        p->packet.callback = transmit_phy_packet_callback;
+        init_completion(&p->done);
+        kref_set(&p->kref, 2);
+
+        card->driver->send_request(card, &p->packet);
+        timeout = wait_for_completion_timeout(&p->done, timeout);
+        kref_put(&p->kref, phy_packet_release);
+
+        /* will leak p if the callback is never executed */
+        WARN_ON(timeout == 0);
 }
 
 void fw_flush_transactions(struct fw_card *card)
@@ -572,7 +591,8 @@ allocate_request(struct fw_packet *p)
                 break;
 
         default:
-                BUG();
+                fw_error("ERROR - corrupt request received - %08x %08x %08x\n",
+                         p->header[0], p->header[1], p->header[2]);
                 return NULL;
         }