diff mbox series

[U-Boot,RESEND,v2] usb: gadget: f_dfu.c: fix memory leak

Message ID 20190628144202.27375-1-ralph.siemsen@linaro.org
State Accepted
Commit fe876984a428cc0058bdb536ac948397762f3c0d
Delegated to: Lukasz Majewski
Headers show
Series [U-Boot,RESEND,v2] usb: gadget: f_dfu.c: fix memory leak | expand

Commit Message

Ralph Siemsen June 28, 2019, 2:42 p.m. UTC 
dfu_prepare_function() allocates N+1 descriptor header structures,
the last one being the "DFU Functional Descriptor".

dfu_unbind() handles de-allocation, but fails to free the final
one (eg. "DFU Functional Descriptor"), leading to memory leak.

Fixed by incrementing counter, as in dfu_prepare_function().

Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
---

Changes in v2:
Remove incorrect note.
Fix spelling error in commit message.

 drivers/usb/gadget/f_dfu.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 30ece524a8..e27f146605 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -748,6 +748,7 @@  static void dfu_unbind(struct usb_configuration *c, struct usb_function *f)
 
 	if (f_dfu->function) {
 		i = alt_num;
+		i++; /* free DFU Functional Descriptor */
 		while (i) {
 			free(f_dfu->function[--i]);
 			f_dfu->function[i] = NULL;