dmaengine: fix dmaengine_unmap failure

The count which is used to get_unmap_data maybe not the same as the
count computed in dmaengine_unmap which causes to free data in a
wrong pool.

This patch fixes this issue by keeping the map count with unmap_data
structure and use this count to get the pool.

Cc: <stable@vger.kernel.org>
Signed-off-by: Xuelin Shi <xuelin.shi@freescale.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index a886713937fd..d5d30ed863ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1009,6 +1009,7 @@ static void dmaengine_unmap(struct kref *kref)
                 dma_unmap_page(dev, unmap->addr[i], unmap->len,
                                DMA_BIDIRECTIONAL);
         }
+        cnt = unmap->map_cnt;
         mempool_free(unmap, __get_unmap_pool(cnt)->pool);
 }
 
@@ -1074,6 +1075,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
         memset(unmap, 0, sizeof(*unmap));
         kref_init(&unmap->kref);
         unmap->dev = dev;
+        unmap->map_cnt = nr;
 
         return unmap;
 }