[PATCH] usb: musb: gadget: fix possible NULL pointer dereference

[John Ogness]

txstate() assumes that if the request buffer is mapped, a DMA channel
is allocated. There is a case here where the DMA channel is released
and then shortly thereafter (in general PIO code) the request buffer
is unmapped. However, in this case unmap_dma_buffer() silently fails
because the DMA channel is already gone. Thus, the next time txstate()
is called, there is a NULL pointer exception because the buffer is
mapped but no DMA channel is allocated.

This patch adds an extra call unmap_dma_buffer() before releasing the
channel.

Signed-off-by: John Ogness <john.ogness@xxxxxxxxxxxxx>
---
 patch against next-20160226

 drivers/usb/musb/musb_gadget.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 87bd578..c518d3c 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -393,6 +393,7 @@ static void txstate(struct musb *musb, struct musb_request *req)
 					request->dma + request->actual,
 					request_size);
 			if (!use_dma) {
+				unmap_dma_buffer(req, musb);
 				c->channel_release(musb_ep->dma);
 				musb_ep->dma = NULL;
 				csr &= ~MUSB_TXCSR_DMAENAB;
-- 
1.7.10.4