[PATCH] usb: xhci: call dma_unmap_single in error paths

[Ahmad Fatoum]

xHCI ring handling maps buffers prior to DMA and unmaps them on success,
but leaves them mapped in the error case. This leads to buffers being
remapped again triggering a CONFIG_DMA_API_DEBUG warning along with
a stack trace:

  WARNING: dwc3 2f00000.usb at 2f00000.of: from-device mapping 0xbdfa0000+0x800: duplicate mapping

Fix this by unmapping the code in the error case too. This is ok to do,
because in the first instace, DMA hasn't been enabled yet and in the
others abort_td() called beforehand terminates it.

Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 drivers/usb/host/xhci-ring.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 995772f92722..547047305dd0 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -639,8 +639,10 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
 	 */
 	ret = prepare_ring(ctrl, ring,
 			   le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
-	if (ret < 0)
+	if (ret < 0) {
+		dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
 		return ret;
+	}
 
 	/*
 	 * Don't give the first TRB to the hardware (by toggling the cycle bit)
@@ -725,6 +727,7 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
 		abort_td(udev, ep_index);
 		udev->status = USB_ST_NAK_REC;  /* closest thing to a timeout */
 		udev->act_len = 0;
+		dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
 		return -ETIMEDOUT;
 	}
 	field = le32_to_cpu(event->trans_event.flags);
@@ -967,5 +970,6 @@ int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe,
 	abort_td(udev, ep_index);
 	udev->status = USB_ST_NAK_REC;
 	udev->act_len = 0;
+	dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
 	return -ETIMEDOUT;
 }
-- 
2.39.2