[U-Boot] [PATCH] gadget: f_thor: Fix memory leaks of usb request and its buffer

[Seung-Woo Kim]

There are memory leaks of usb request and its buffer for ep0,
in_ep, and out ep. Fix memory leaks of usb request and its buffer.

Signed-off-by: Seung-Woo Kim <sw0312....@samsung.com>
---
 drivers/usb/gadget/f_thor.c |   34 +++++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/gadget/f_thor.c b/drivers/usb/gadget/f_thor.c
index c8eda05..ec8bd50 100644
--- a/drivers/usb/gadget/f_thor.c
+++ b/drivers/usb/gadget/f_thor.c
@@ -752,6 +752,13 @@ int thor_handle(void)
        return 0;
 }
 
+static void free_ep_req(struct usb_ep *ep, struct usb_request *req)
+{
+       if (req->buf)
+               free(req->buf);
+       usb_ep_free_request(ep, req);
+}
+
 static int thor_func_bind(struct usb_configuration *c, struct usb_function *f)
 {
        struct usb_gadget *gadget = c->cdev->gadget;
@@ -860,21 +867,18 @@ static int thor_func_bind(struct usb_configuration *c, 
struct usb_function *f)
        return 0;
 
  fail:
+       if (dev->req)
+               free_ep_req(gadget->ep0, dev->req);
        free(dev);
        return status;
 }
 
-static void free_ep_req(struct usb_ep *ep, struct usb_request *req)
-{
-       free(req->buf);
-       usb_ep_free_request(ep, req);
-}
-
 static void thor_unbind(struct usb_configuration *c, struct usb_function *f)
 {
        struct f_thor *f_thor = func_to_thor(f);
        struct thor_dev *dev = f_thor->dev;
 
+       free_ep_req(dev->gadget->ep0, dev->req);
        free(dev);
        memset(thor_func, 0, sizeof(*thor_func));
        thor_func = NULL;
@@ -895,9 +899,9 @@ static void thor_func_disable(struct usb_function *f)
        }
 
        if (dev->out_ep->driver_data) {
-               free(dev->out_req->buf);
+               /* buf of out_req is set with thor_set_dma(), so just clear */
                dev->out_req->buf = NULL;
-               usb_ep_free_request(dev->out_ep, dev->out_req);
+               free_ep_req(dev->out_ep, dev->out_req);
                usb_ep_disable(dev->out_ep);
                dev->out_ep->driver_data = NULL;
        }
@@ -940,17 +944,29 @@ static int thor_eps_setup(struct usb_function *f)
        debug("(d)bEndpointAddress: 0x%x\n", d->bEndpointAddress);
 
        result = usb_ep_enable(ep, d);
-       if (result)
+       if (result) {
+               free_ep_req(dev->in_ep, dev->in_req);
+               dev->in_req = NULL;
+               usb_ep_disable(dev->in_ep);
                goto exit;
+       }
 
        ep->driver_data = cdev; /* claim */
        req = thor_start_ep(ep);
        if (!req) {
                usb_ep_disable(ep);
+               free_ep_req(dev->in_ep, dev->in_req);
+               dev->in_req = NULL;
+               usb_ep_disable(dev->in_ep);
                result = -EIO;
                goto exit;
        }
 
+       /* buf of out_req will be set with thor_set_dma(), so clear it */
+       free(req->buf);
+       req->buf = NULL;
+       req->length = 0;
+
        dev->out_req = req;
        /* ACM control EP */
        ep = dev->int_ep;
-- 
1.7.9.5

_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
https://lists.denx.de/listinfo/u-boot