[PATCH] usb: xhci: call dma_unmap_single in error paths

[PATCH] usb: xhci: call dma_unmap_single in error paths

[Ahmad Fatoum]

xHCI ring handling maps buffers prior to DMA and unmaps them on success,
but leaves them mapped in the error case. This leads to buffers being
remapped again triggering a CONFIG_DMA_API_DEBUG warning along with
a stack trace:

  WARNING: dwc3 2f00000.usb@2f00000.of: from-device mapping 0xbdfa0000+0x800: duplicate mapping

Fix this by unmapping the code in the error case too. This is ok to do,
because in the first instace, DMA hasn't been enabled yet and in the
others abort_td() called beforehand terminates it.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/usb/host/xhci-ring.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 995772f92722..547047305dd0 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -639,8 +639,10 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
 	 */
 	ret = prepare_ring(ctrl, ring,
 			   le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
-	if (ret < 0)
+	if (ret < 0) {
+		dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
 		return ret;
+	}
 
 	/*
 	 * Don't give the first TRB to the hardware (by toggling the cycle bit)
@@ -725,6 +727,7 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
 		abort_td(udev, ep_index);
 		udev->status = USB_ST_NAK_REC;  /* closest thing to a timeout */
 		udev->act_len = 0;
+		dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
 		return -ETIMEDOUT;
 	}
 	field = le32_to_cpu(event->trans_event.flags);
@@ -967,5 +970,6 @@ int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe,
 	abort_td(udev, ep_index);
 	udev->status = USB_ST_NAK_REC;
 	udev->act_len = 0;
+	dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
 	return -ETIMEDOUT;
 }
-- 
2.39.2

Re: [PATCH] usb: xhci: call dma_unmap_single in error paths

[Sascha Hauer]

On Tue, Jan 09, 2024 at 01:02:01PM +0100, Ahmad Fatoum wrote:
> xHCI ring handling maps buffers prior to DMA and unmaps them on success,
> but leaves them mapped in the error case. This leads to buffers being
> remapped again triggering a CONFIG_DMA_API_DEBUG warning along with
> a stack trace:
> 
>   WARNING: dwc3 2f00000.usb@2f00000.of: from-device mapping 0xbdfa0000+0x800: duplicate mapping
> 
> Fix this by unmapping the code in the error case too. This is ok to do,
> because in the first instace, DMA hasn't been enabled yet and in the
> others abort_td() called beforehand terminates it.
> 
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  drivers/usb/host/xhci-ring.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)

Applied, thanks

Sascha

> 
> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> index 995772f92722..547047305dd0 100644
> --- a/drivers/usb/host/xhci-ring.c
> +++ b/drivers/usb/host/xhci-ring.c
> @@ -639,8 +639,10 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
>  	 */
>  	ret = prepare_ring(ctrl, ring,
>  			   le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
> -	if (ret < 0)
> +	if (ret < 0) {
> +		dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
>  		return ret;
> +	}
>  
>  	/*
>  	 * Don't give the first TRB to the hardware (by toggling the cycle bit)
> @@ -725,6 +727,7 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
>  		abort_td(udev, ep_index);
>  		udev->status = USB_ST_NAK_REC;  /* closest thing to a timeout */
>  		udev->act_len = 0;
> +		dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
>  		return -ETIMEDOUT;
>  	}
>  	field = le32_to_cpu(event->trans_event.flags);
> @@ -967,5 +970,6 @@ int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe,
>  	abort_td(udev, ep_index);
>  	udev->status = USB_ST_NAK_REC;
>  	udev->act_len = 0;
> +	dma_unmap_single(ctrl->host.hw_dev, map, length, direction);
>  	return -ETIMEDOUT;
>  }
> -- 
> 2.39.2
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |