[PATCH] usb: gadget: pch_udc: Fix potential ep0 DMA descriptor leak

[Guangshuo Li <liguangshuo@mail.sdu.edu.cn>]

Removal destroys data_requests while the ep0 data descriptor is still
allocated, then tries to return that descriptor to stp_requests. The
busy data pool cannot release its DMA backing memory.

Return the descriptor to data_requests before destroying that pool.

This issue was found by our static analysis tool under development.

Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 drivers/usb/gadget/udc/pch_udc.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 99b3ce28210f..5996f1d16aed 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -2989,6 +2989,10 @@ static void pch_udc_remove(struct pci_dev *pdev)
 		dev_err(&pdev->dev,
 			"%s: gadget driver still bound!!!\n", __func__);
 	/* dma pool cleanup */
+	if (dev->ep[UDC_EP0OUT_IDX].td_data)
+		dma_pool_free(dev->data_requests,
+			      dev->ep[UDC_EP0OUT_IDX].td_data,
+			      dev->ep[UDC_EP0OUT_IDX].td_data_phys);
 	dma_pool_destroy(dev->data_requests);
 
 	if (dev->stp_requests) {
@@ -2998,11 +3002,6 @@ static void pch_udc_remove(struct pci_dev *pdev)
 				dev->ep[UDC_EP0OUT_IDX].td_stp,
 				dev->ep[UDC_EP0OUT_IDX].td_stp_phys);
 		}
-		if (dev->ep[UDC_EP0OUT_IDX].td_data) {
-			dma_pool_free(dev->stp_requests,
-				dev->ep[UDC_EP0OUT_IDX].td_data,
-				dev->ep[UDC_EP0OUT_IDX].td_data_phys);
-		}
 		dma_pool_destroy(dev->stp_requests);
 	}
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4