firewire: fw-ohci: plug dma memory leak in AR handler

index 8ff9059..e1d50f7 100644
@@ -579,7 +579,8 @@ static void ar_context_tasklet(unsigned long data)
 
 	if (d->res_count == 0) {
 		size_t size, rest, offset;
-		dma_addr_t buffer_bus;
+		dma_addr_t start_bus;
+		void *start;
 
 		/*
 		 * This descriptor is finished and we may have a

@@ -588,9 +589,9 @@ static void ar_context_tasklet(unsigned long data)
 		 */
 
 		offset = offsetof(struct ar_buffer, data);
-		buffer_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
+		start = buffer = ab;
+		start_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
 
-		buffer = ab;
 		ab = ab->next;
 		d = &ab->descriptor;
 		size = buffer + PAGE_SIZE - ctx->pointer;

@@ -605,7 +606,7 @@ static void ar_context_tasklet(unsigned long data)
 			buffer = handle_ar_packet(ctx, buffer);
 
 		dma_free_coherent(ohci->card.device, PAGE_SIZE,
-				  buffer, buffer_bus);
+				  start, start_bus);
 		ar_context_add_page(ctx);
 	} else {
 		buffer = ctx->pointer;

Index: linux/drivers/firewire/fw-ohci.c
===================================================================
@@ -451,14 +451,19 @@ ohci_update_phy_reg(struct fw_card *card
 	return 0;
 }
 
-static int ar_context_add_page(struct ar_context *ctx)
+static int ar_context_add_page(struct ar_context *ctx, struct ar_buffer *ab)
 {
 	struct device *dev = ctx->ohci->card.device;
-	struct ar_buffer *ab;
 	dma_addr_t uninitialized_var(ab_bus);
-	size_t offset;
+	size_t offset = offsetof(struct ar_buffer, data);
 
-	ab = dma_alloc_coherent(dev, PAGE_SIZE, &ab_bus, GFP_ATOMIC);
+	if (ab == NULL)
+		ab = dma_alloc_coherent(dev, PAGE_SIZE, &ab_bus, GFP_KERNEL);
+	else {
+		ab_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
+		fw_notify("=== %s ===\n",
+			  ctx == &ctx->ohci->ar_request_ctx  ? "Req " : "Resp");
+	}
 	if (ab == NULL)
 		return -ENOMEM;
 

@@ -466,7 +471,6 @@ static int ar_context_add_page(struct ar
 	ab->descriptor.control        = cpu_to_le16(DESCRIPTOR_INPUT_MORE |
 						    DESCRIPTOR_STATUS |
 						    DESCRIPTOR_BRANCH_ALWAYS);
-	offset = offsetof(struct ar_buffer, data);
 	ab->descriptor.req_count      = cpu_to_le16(PAGE_SIZE - offset);
 	ab->descriptor.data_address   = cpu_to_le32(ab_bus + offset);
 	ab->descriptor.res_count      = cpu_to_le16(PAGE_SIZE - offset);

@@ -569,8 +573,7 @@ static __le32 *handle_ar_packet(struct a
 static void ar_context_tasklet(unsigned long data)
 {
 	struct ar_context *ctx = (struct ar_context *)data;
-	struct fw_ohci *ohci = ctx->ohci;
-	struct ar_buffer *ab;
+	struct ar_buffer *ab, *old_ab;
 	struct descriptor *d;
 	void *buffer, *end;
 

@@ -578,9 +581,7 @@ static void ar_context_tasklet(unsigned 
 	d = &ab->descriptor;
 
 	if (d->res_count == 0) {
-		size_t size, rest, offset;
-		dma_addr_t start_bus;
-		void *start;
+		size_t size, rest;
 
 		/*
 		 * This descriptor is finished and we may have a

@@ -588,10 +589,7 @@ static void ar_context_tasklet(unsigned 
 		 * reuse the page for reassembling the split packet.
 		 */
 
-		offset = offsetof(struct ar_buffer, data);
-		start = buffer = ab;
-		start_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
-
+		buffer = old_ab = ab;
 		ab = ab->next;
 		d = &ab->descriptor;
 		size = buffer + PAGE_SIZE - ctx->pointer;

@@ -605,9 +603,7 @@ static void ar_context_tasklet(unsigned 
 		while (buffer < end)
 			buffer = handle_ar_packet(ctx, buffer);
 
-		dma_free_coherent(ohci->card.device, PAGE_SIZE,
-				  start, start_bus);
-		ar_context_add_page(ctx);
+		ar_context_add_page(ctx, old_ab);
 	} else {
 		buffer = ctx->pointer;
 		ctx->pointer = end =

@@ -628,8 +624,8 @@ ar_context_init(struct ar_context *ctx, 
 	ctx->last_buffer = &ab;
 	tasklet_init(&ctx->tasklet, ar_context_tasklet, (unsigned long)ctx);
 
-	ar_context_add_page(ctx);
-	ar_context_add_page(ctx);
+	ar_context_add_page(ctx, NULL);
+	ar_context_add_page(ctx, NULL);
 	ctx->current_buffer = ab.next;
 	ctx->pointer = ctx->current_buffer->data;