Two minor rp1-pio fixes

[pelwell]

1. Use the correct DMA device pointer in the DMA free calls.
2. Set dma->cyclic earlier so it is available to rp1_pio_sm_dma_free in the error path.
3. Set an error code in the case that the cyclic preparation fails.

[popcornmix]

misc: rp1-pio: Use the correct dev in dma_free

Looks good. dma_dev is read before dma_release_channel(), and dma->chan is valid on every path that reaches the free.

misc: rp1-pio: Minor cyclic DMA error path fixes

• Failing the cyclic allocation still takes the wrong path. dma->cyclic = cyclic now comes after the dma_alloc_coherent() has succeeded. But dma->buf_count = buf_count is set before it. If that allocation fails, rp1_pio_sm_dma_free() sees cyclic == false and buf_count == N, and runs the non-cyclic loop over bufs[0..N-1]. bufs[0].buf is NULL (dma_free_coherent() ignores that). bufs[1..] still hold pointers from an earlier non-cyclic configuration of that SM, which have already been freed, because rp1_pio_sm_dma_free() never clears them. So this is a double free. User space can trigger it easily: close after a non-cyclic configuration of an SM, then ask for a cyclic buf_size * buf_count too large to allocate. The simplest fix is to set dma->cyclic = cyclic before the allocation: the cyclic branch of the free then passes a NULL bufs[0].buf, which is harmless. Clearing buf/dma_addr after freeing would also stop stale pointers doing damage later.
• Nit: the other "DMA preparation failed" paths return -EIO. -ENOMEM here is defensible, but -EIO would match them.