[PATCH 4/4] usb: gadget: pch_udc: free the EP0 data descriptor to its owning pool

[Myeonghun Pak]

The EP0 OUT data descriptor is allocated from data_requests, but
cleanup destroys that pool before passing the descriptor to
stp_requests. Return it to data_requests before destroying the
owning pool. Keep the setup descriptor on stp_requests.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
Compile-tested only.

 drivers/usb/gadget/udc/pch_udc.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 38b9159e2461..b07da0fdcdfc 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -2984,20 +2984,21 @@ static void pch_udc_cleanup(struct pch_udc_dev *dev)
 	}
 
 	/* dma pool cleanup */
-	dma_pool_destroy(dev->data_requests);
+	if (dev->data_requests) {
+		if (dev->ep[UDC_EP0OUT_IDX].td_data)
+			dma_pool_free(dev->data_requests,
+				      dev->ep[UDC_EP0OUT_IDX].td_data,
+				      dev->ep[UDC_EP0OUT_IDX].td_data_phys);
+		dma_pool_destroy(dev->data_requests);
+	}
 
 	if (dev->stp_requests) {
-		/* cleanup DMA desc's for ep0in */
+		/* Free the EP0 OUT setup descriptor. */
 		if (dev->ep[UDC_EP0OUT_IDX].td_stp) {
 			dma_pool_free(dev->stp_requests,
 				dev->ep[UDC_EP0OUT_IDX].td_stp,
 				dev->ep[UDC_EP0OUT_IDX].td_stp_phys);
 		}
-		if (dev->ep[UDC_EP0OUT_IDX].td_data) {
-			dma_pool_free(dev->stp_requests,
-				dev->ep[UDC_EP0OUT_IDX].td_data,
-				dev->ep[UDC_EP0OUT_IDX].td_data_phys);
-		}
 		dma_pool_destroy(dev->stp_requests);
 	}