Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad6b1b97 authored by Marc Kleine-Budde's avatar Marc Kleine-Budde Committed by Greg Kroah-Hartman
Browse files

usb: chipidea: cleanup dma_pool if udc_start() fails 



If udc_start() fails the qh_pool dma-pool cannot be closed because
it's still in use. This patch factors out the dma_pool_free() loop
into destroy_eps() and calls it in the error path of udc_start(),
too.

Cc: stable <stable@vger.kernel.org>
Reviewed-by: default avatarRichard Zhao <richard.zhao@freescale.com>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c9d1f947

drivers/usb/chipidea/udc.c

+15 −8
Original line number Diff line number Diff line
@@ -1503,6 +1503,17 @@ static int init_eps(struct ci13xxx *ci) 
	return retval;

}



static void destroy_eps(struct ci13xxx *ci)

{

	int i;



	for (i = 0; i < ci->hw_ep_max; i++) {

		struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];



		dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);

	}

}



/**

 * ci13xxx_start: register a gadget driver

 * @gadget: our gadget
@@ -1710,7 +1721,7 @@ static int udc_start(struct ci13xxx *ci) 
	if (ci->platdata->flags & CI13XXX_REQUIRE_TRANSCEIVER) {

		if (ci->transceiver == NULL) {

			retval = -ENODEV;

			goto free_pools;

			goto destroy_eps;

		}

	}
@@ -1761,6 +1772,8 @@ unreg_device: 
put_transceiver:

	if (!IS_ERR_OR_NULL(ci->transceiver) && ci->global_phy)

		usb_put_phy(ci->transceiver);

destroy_eps:

	destroy_eps(ci);

free_pools:

	dma_pool_destroy(ci->td_pool);

free_qh_pool:
@@ -1775,18 +1788,12 @@ free_qh_pool: 
 */

static void udc_stop(struct ci13xxx *ci)

{

	int i;



	if (ci == NULL)

		return;



	usb_del_gadget_udc(&ci->gadget);



	for (i = 0; i < ci->hw_ep_max; i++) {

		struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];



		dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);

	}

	destroy_eps(ci);



	dma_pool_destroy(ci->td_pool);

	dma_pool_destroy(ci->qh_pool);