2 files changed, 12 insertions, 17 deletions

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1c5c9ba141db..c4b8959e01e7 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1666,18 +1666,10 @@ struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
 
 void xhci_urb_free_priv(struct xhci_hcd *xhci, struct urb_priv *urb_priv)
 {
-        int last;
-
-        if (!urb_priv)
-                return;
-
-        last = urb_priv->length - 1;
-        if (last >= 0) {
-                int     i;
-                for (i = 0; i <= last; i++)
-                        kfree(urb_priv->td[i]);
+        if (urb_priv) {
+                kfree(urb_priv->td[0]);
+                kfree(urb_priv);
         }
-        kfree(urb_priv);
 }
 
 void xhci_free_command(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 40b82f7e4297..6440bd210c48 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1035,6 +1035,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
 int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct xhci_td *buffer;
         unsigned long flags;
         int ret = 0;
         unsigned int slot_id, ep_index;
@@ -1065,13 +1066,15 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
         if (!urb_priv)
                 return -ENOMEM;
 
+        buffer = kzalloc(size * sizeof(struct xhci_td), mem_flags);
+        if (!buffer) {
+                kfree(urb_priv);
+                return -ENOMEM;
+        }
+
         for (i = 0; i < size; i++) {
-                urb_priv->td[i] = kzalloc(sizeof(struct xhci_td), mem_flags);
-                if (!urb_priv->td[i]) {
-                        urb_priv->length = i;
-                        xhci_urb_free_priv(xhci, urb_priv);
-                        return -ENOMEM;
-                }
+                urb_priv->td[i] = buffer;
+                buffer++;
         }
 
         urb_priv->length = size;