[PATCH 3/4] usb: gadget: pch_udc: track successful EP0 DMA mappings

[Myeonghun Pak]

DMA address zero is valid, and a failed dma_map_single() does not
create a mapping to unmap. Track successful mapping explicitly so
cleanup handles both cases correctly. Return -EIO on mapping failure
instead of returning the positive dma_mapping_error() result.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
Compile-tested only.

 drivers/usb/gadget/udc/pch_udc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index c360bc556cdc..38b9159e2461 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -328,6 +328,7 @@ struct pch_vbus_gpio_data {
  * @data_requests:	DMA pool for data requests
  * @stp_requests:	DMA pool for setup requests
  * @dma_addr:		DMA pool for received
+ * @dma_mapped:		EP0 receive buffer has a valid DMA mapping
  * @setup_data:		Received setup data
  * @base_addr:		for mapped device memory
  * @bar:		PCI BAR used for mapped device memory
@@ -351,6 +352,7 @@ struct pch_udc_dev {
 	struct dma_pool		*data_requests;
 	struct dma_pool		*stp_requests;
 	dma_addr_t			dma_addr;
+	bool				dma_mapped;
 	struct usb_ctrlrequest		setup_data;
 	void __iomem			*base_addr;
 	unsigned short			bar;
@@ -2887,7 +2889,10 @@ static int init_dma_pools(struct pch_udc_dev *dev)
 	dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf,
 				       UDC_EP0OUT_BUFF_SIZE * 4,
 				       DMA_FROM_DEVICE);
-	return dma_mapping_error(&dev->pdev->dev, dev->dma_addr);
+	if (dma_mapping_error(&dev->pdev->dev, dev->dma_addr))
+		return -EIO;
+	dev->dma_mapped = true;
+	return 0;
 }
 
 static int pch_udc_start(struct usb_gadget *g,
@@ -2996,7 +3001,7 @@ static void pch_udc_cleanup(struct pch_udc_dev *dev)
 		dma_pool_destroy(dev->stp_requests);
 	}
 
-	if (dev->dma_addr)
+	if (dev->dma_mapped)
 		dma_unmap_single(&dev->pdev->dev, dev->dma_addr,
 				 UDC_EP0OUT_BUFF_SIZE * 4, DMA_FROM_DEVICE);
 }