Revert "CHROMIUM: bluetooth/usb: hack to cover up dma after free corruption"

This reverts commit 27aeb810c5f03bbb434378e0c4b4bc3f25b35a2e.

Merge to R25 was premature, reverting.

BUG=chrome-os-partner:17614
TEST=none

Change-Id: I9999a3f4562b4aa5348edc3aba707896f55efe56
Reviewed-on: https://gerrit.chromium.org/gerrit/43942
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
Tested-by: Sonny Rao <sonnyrao@chromium.org>

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3df1d5c624e078795f3d60f34f8e56ad16ac15d1..b5cbe27c6e230543e165ad8879bdfc027b5c95e3 100644 (file)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -56,13 +56,6 @@ static struct usb_driver btusb_driver;
 #define BTUSB_WRONG_SCO_MTU    0x40
 #define BTUSB_ATH3012          0x80
 
-/* Hack to deal with USB controllers/devices which */
-/* DMA after we shut the device down and kill the URB */
-static struct kmem_cache *btusb_intr_buf_cache;
-
-/* Max interrupt packet size for a full-speed device is 64 bytes */
-#define BTUSB_INTR_BUF_SIZE (64)
-
 static struct usb_device_id btusb_table[] = {
        /* Generic Bluetooth USB device */
        { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
@@ -323,8 +316,7 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 
        size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 
-       BUG_ON(size > BTUSB_INTR_BUF_SIZE);
-       buf = kmem_cache_alloc(btusb_intr_buf_cache, mem_flags);
+       buf = kmalloc(size, mem_flags);
        if (!buf) {
                usb_free_urb(urb);
                return -ENOMEM;
@@ -336,8 +328,7 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
                                                btusb_intr_complete, hdev,
                                                data->intr_ep->bInterval);
 
-       /* HACK: intentionally leak this buffer due to DMA after free */
-       /* urb->transfer_flags |= URB_FREE_BUFFER; */
+       urb->transfer_flags |= URB_FREE_BUFFER;
 
        usb_anchor_urb(urb, &data->intr_anchor);
 
@@ -928,16 +919,6 @@ static int btusb_probe(struct usb_interface *intf,
 
        BT_DBG("intf %p id %p", intf, id);
 
-       if (!btusb_intr_buf_cache) {
-               btusb_intr_buf_cache = kmem_cache_create("btusb_intr_buf",
-                                                        BTUSB_INTR_BUF_SIZE,
-                                                        BTUSB_INTR_BUF_SIZE,
-                                                        SLAB_RED_ZONE |
-                                                        SLAB_POISON,
-                                                        NULL);
-               BUG_ON(!btusb_intr_buf_cache);
-       }
-
        /* interface numbers are hardcoded in the spec */
        if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
                return -ENODEV;