[U-Boot] [PATCH] usb: gadget: f_dfu.c: fix memory leak

[U-Boot] [PATCH] usb: gadget: f_dfu.c: fix memory leak

[Ralph Siemsen]

dfu_prepare_function() allocates N+1 descriptor header structures,
the last one being the "DFU Functional Descriptor".

dfu_unbind() handles de-allocation, but failes to free the final
one (eg. "DFU Functional Descriptor"), leading to memory leak.

Fixed by incrementing counter, as in dfu_prepare_function().

Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
---

Notes:
    The array of pointers allocated in dfu_prepare_function() is larger
    than necessary. For some reason it is N+2 when N+1 would suffice.
    Not a memory leak, so did not address in this commit.

 drivers/usb/gadget/f_dfu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 30ece524a8..e27f146605 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration *c, struct usb_function *f)
 
 	if (f_dfu->function) {
 		i = alt_num;
+		i++; /* free DFU Functional Descriptor */
 		while (i) {
 			free(f_dfu->function[--i]);
 			f_dfu->function[i] = NULL;
-- 
2.17.1

[U-Boot] [PATCH] usb: gadget: f_dfu.c: fix memory leak

[Ralph Siemsen]

Small correction:

> Notes:
>     The array of pointers allocated in dfu_prepare_function() is larger
>     than necessary. For some reason it is N+2 when N+1 would suffice.
>     Not a memory leak, so did not address in this commit.

Please ignore that note... the N+2 element is indeed needed, it
serves as NULL terminator for the list. Not sure how I missed that.

Ralph

[U-Boot] [RESEND PATCH v2] usb: gadget: f_dfu.c: fix memory leak

[Ralph Siemsen]

dfu_prepare_function() allocates N+1 descriptor header structures,
the last one being the "DFU Functional Descriptor".

dfu_unbind() handles de-allocation, but fails to free the final
one (eg. "DFU Functional Descriptor"), leading to memory leak.

Fixed by incrementing counter, as in dfu_prepare_function().

Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
---

Changes in v2:
Remove incorrect note.
Fix spelling error in commit message.

 drivers/usb/gadget/f_dfu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 30ece524a8..e27f146605 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration *c, struct usb_function *f)
 
 	if (f_dfu->function) {
 		i = alt_num;
+		i++; /* free DFU Functional Descriptor */
 		while (i) {
 			free(f_dfu->function[--i]);
 			f_dfu->function[i] = NULL;
-- 
2.17.1

[U-Boot] [PATCH] usb: gadget: f_dfu.c: fix memory leak

[Lukasz Majewski]

Hi Ralph,

> dfu_prepare_function() allocates N+1 descriptor header structures,
> the last one being the "DFU Functional Descriptor".
> 
> dfu_unbind() handles de-allocation, but failes to free the final
> one (eg. "DFU Functional Descriptor"), leading to memory leak.
> 
> Fixed by incrementing counter, as in dfu_prepare_function().
> 
> Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>

Thank you for the fix. I've just noticed it (as I was not on CC).

For the future patches please either use patman tool:
https://github.com/ARM-software/u-boot/tree/master/tools/patman

or use get_maitainer script, so the patch will be send directly to
responsible custodian (Maitainer).

> ---
> 
> Notes:
>     The array of pointers allocated in dfu_prepare_function() is
> larger than necessary. For some reason it is N+2 when N+1 would
> suffice. Not a memory leak, so did not address in this commit.
> 
>  drivers/usb/gadget/f_dfu.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
> index 30ece524a8..e27f146605 100644
> --- a/drivers/usb/gadget/f_dfu.c
> +++ b/drivers/usb/gadget/f_dfu.c
> @@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration
> *c, struct usb_function *f) 
>  	if (f_dfu->function) {
>  		i = alt_num;
> +		i++; /* free DFU Functional Descriptor */
>  		while (i) {
>  			free(f_dfu->function[--i]);
>  			f_dfu->function[i] = NULL;




Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20190704/48e49537/attachment.sig>