usb: dwc3: gadget: only unmap requests from DMA if mapped

A recent optimization was made so that a request put on the
pending_list wouldn't get mapped for DMA until just before
preparing a TRB for it. However, this poses a problem in case
the request is dequeued or the endpoint is disabled before the
mapping is done as that would lead to dwc3_gadget_giveback()
unconditionally calling usb_gadget_unmap_request_for_dev() with
an invalid request->dma handle. Depending on the platform's DMA
implementation the unmap operation could result in a panic.

Since we know a successful mapping is a prerequisite for getting
a TRB, the unmap can be conditionally called only when req->trb
is non-NULL.

Fixes: cdb55b39fab8 ("usb: dwc3: gadget: lazily map requests for DMA")
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9e41605a276ba8bc8718340272f2cf21d27cfed7..6b299c7b765611e0cb6c0d30e5de50f8ef279cb7 100644 (file)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -191,14 +191,16 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
 
        req->started = false;
        list_del(&req->list);
-       req->trb = NULL;
        req->remaining = 0;
 
        if (req->request.status == -EINPROGRESS)
                req->request.status = status;
 
-       usb_gadget_unmap_request_by_dev(dwc->sysdev,
-                                       &req->request, req->direction);
+       if (req->trb)
+               usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                               &req->request, req->direction);
+
+       req->trb = NULL;
 
        trace_dwc3_gadget_giveback(req);