From mboxrd@z Thu Jan 1 00:00:00 1970 From: Seung-Woo Kim Date: Wed, 23 May 2018 16:25:45 +0900 Subject: [U-Boot] [PATCH] gadget: f_thor: Fix memory leaks of usb request and its buffer References: Message-ID: <1527060345-23134-1-git-send-email-sw0312.kim@samsung.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de There are memory leaks of usb request and its buffer for ep0, in_ep, and out ep. Fix memory leaks of usb request and its buffer. Signed-off-by: Seung-Woo Kim --- drivers/usb/gadget/f_thor.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/drivers/usb/gadget/f_thor.c b/drivers/usb/gadget/f_thor.c index c8eda05..ec8bd50 100644 --- a/drivers/usb/gadget/f_thor.c +++ b/drivers/usb/gadget/f_thor.c @@ -752,6 +752,13 @@ int thor_handle(void) return 0; } +static void free_ep_req(struct usb_ep *ep, struct usb_request *req) +{ + if (req->buf) + free(req->buf); + usb_ep_free_request(ep, req); +} + static int thor_func_bind(struct usb_configuration *c, struct usb_function *f) { struct usb_gadget *gadget = c->cdev->gadget; @@ -860,21 +867,18 @@ static int thor_func_bind(struct usb_configuration *c, struct usb_function *f) return 0; fail: + if (dev->req) + free_ep_req(gadget->ep0, dev->req); free(dev); return status; } -static void free_ep_req(struct usb_ep *ep, struct usb_request *req) -{ - free(req->buf); - usb_ep_free_request(ep, req); -} - static void thor_unbind(struct usb_configuration *c, struct usb_function *f) { struct f_thor *f_thor = func_to_thor(f); struct thor_dev *dev = f_thor->dev; + free_ep_req(dev->gadget->ep0, dev->req); free(dev); memset(thor_func, 0, sizeof(*thor_func)); thor_func = NULL; @@ -895,9 +899,9 @@ static void thor_func_disable(struct usb_function *f) } if (dev->out_ep->driver_data) { - free(dev->out_req->buf); + /* buf of out_req is set with thor_set_dma(), so just clear */ dev->out_req->buf = NULL; - usb_ep_free_request(dev->out_ep, dev->out_req); + free_ep_req(dev->out_ep, dev->out_req); usb_ep_disable(dev->out_ep); dev->out_ep->driver_data = NULL; } @@ -940,17 +944,29 @@ static int thor_eps_setup(struct usb_function *f) debug("(d)bEndpointAddress: 0x%x\n", d->bEndpointAddress); result = usb_ep_enable(ep, d); - if (result) + if (result) { + free_ep_req(dev->in_ep, dev->in_req); + dev->in_req = NULL; + usb_ep_disable(dev->in_ep); goto exit; + } ep->driver_data = cdev; /* claim */ req = thor_start_ep(ep); if (!req) { usb_ep_disable(ep); + free_ep_req(dev->in_ep, dev->in_req); + dev->in_req = NULL; + usb_ep_disable(dev->in_ep); result = -EIO; goto exit; } + /* buf of out_req will be set with thor_set_dma(), so clear it */ + free(req->buf); + req->buf = NULL; + req->length = 0; + dev->out_req = req; /* ACM control EP */ ep = dev->int_ep; -- 1.7.9.5