| Message ID | 20190627131632.6570-1-ralph.siemsen@linaro.org |
|---|---|
| State | Superseded |
| Delegated to: | Lukasz Majewski |
| Headers | show |
| Series | [U-Boot] usb: gadget: f_dfu.c: fix memory leak | expand |
Small correction: > Notes: > The array of pointers allocated in dfu_prepare_function() is larger > than necessary. For some reason it is N+2 when N+1 would suffice. > Not a memory leak, so did not address in this commit. Please ignore that note... the N+2 element is indeed needed, it serves as NULL terminator for the list. Not sure how I missed that. Ralph
Hi Ralph, > dfu_prepare_function() allocates N+1 descriptor header structures, > the last one being the "DFU Functional Descriptor". > > dfu_unbind() handles de-allocation, but failes to free the final > one (eg. "DFU Functional Descriptor"), leading to memory leak. > > Fixed by incrementing counter, as in dfu_prepare_function(). > > Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Thank you for the fix. I've just noticed it (as I was not on CC). For the future patches please either use patman tool: https://github.com/ARM-software/u-boot/tree/master/tools/patman or use get_maitainer script, so the patch will be send directly to responsible custodian (Maitainer). > --- > > Notes: > The array of pointers allocated in dfu_prepare_function() is > larger than necessary. For some reason it is N+2 when N+1 would > suffice. Not a memory leak, so did not address in this commit. > > drivers/usb/gadget/f_dfu.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c > index 30ece524a8..e27f146605 100644 > --- a/drivers/usb/gadget/f_dfu.c > +++ b/drivers/usb/gadget/f_dfu.c > @@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration > *c, struct usb_function *f) > if (f_dfu->function) { > i = alt_num; > + i++; /* free DFU Functional Descriptor */ > while (i) { > free(f_dfu->function[--i]); > f_dfu->function[i] = NULL; Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma@denx.de
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c index 30ece524a8..e27f146605 100644 --- a/drivers/usb/gadget/f_dfu.c +++ b/drivers/usb/gadget/f_dfu.c @@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration *c, struct usb_function *f) if (f_dfu->function) { i = alt_num; + i++; /* free DFU Functional Descriptor */ while (i) { free(f_dfu->function[--i]); f_dfu->function[i] = NULL;
dfu_prepare_function() allocates N+1 descriptor header structures, the last one being the "DFU Functional Descriptor". dfu_unbind() handles de-allocation, but failes to free the final one (eg. "DFU Functional Descriptor"), leading to memory leak. Fixed by incrementing counter, as in dfu_prepare_function(). Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> --- Notes: The array of pointers allocated in dfu_prepare_function() is larger than necessary. For some reason it is N+2 when N+1 would suffice. Not a memory leak, so did not address in this commit. drivers/usb/gadget/f_dfu.c | 1 + 1 file changed, 1 insertion(+)