USB: xhci: Fix scratchpad deallocation.

The scratchpad_free() function uses xhci->page_size to free some memory
with pci_free_consistent().  However, the page_size is set to zero before
the call, causing kernel oopses on driver unload.  Call scratchpad_free()
before setting xhci->page_size to zero.

Signed-off-by: Sarah Sharp <[email protected]>
Acked-by: John Youn <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 732580c6cbea398fa58c7f9949fac626a12b9e44..b8fd270a8b0d5f2630ed87dbcf6d24f8a566c86e 100644 (file)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -843,9 +843,9 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
                                xhci->dcbaa, xhci->dcbaa->dma);
        xhci->dcbaa = NULL;
 
+       scratchpad_free(xhci);
        xhci->page_size = 0;
        xhci->page_shift = 0;
-       scratchpad_free(xhci);
 }
 
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)