Keep track of the number of allocated endpoints and use it when freeing the array.
ok? Index: usb_subr.c =================================================================== RCS file: /cvs/src/sys/dev/usb/usb_subr.c,v retrieving revision 1.138 diff -u -p -r1.138 usb_subr.c --- usb_subr.c 19 Jul 2018 12:35:14 -0000 1.138 +++ usb_subr.c 8 Nov 2018 16:10:57 -0000 @@ -515,6 +515,7 @@ usbd_fill_iface_data(struct usbd_device ifc->endpoints = NULL; ifc->priv = NULL; LIST_INIT(&ifc->pipes); + ifc->nendpt = nendpt; if (nendpt != 0) { ifc->endpoints = mallocarray(nendpt, sizeof(*ifc->endpoints), @@ -592,8 +593,8 @@ void usbd_free_iface_data(struct usbd_device *dev, int ifcno) { struct usbd_interface *ifc = &dev->ifaces[ifcno]; - if (ifc->endpoints) - free(ifc->endpoints, M_USB, 0); + + free(ifc->endpoints, M_USB, ifc->nendpt * sizeof(*ifc->endpoints)); } usbd_status Index: usbdi.c =================================================================== RCS file: /cvs/src/sys/dev/usb/usbdi.c,v retrieving revision 1.98 diff -u -p -r1.98 usbdi.c --- usbdi.c 29 Apr 2018 08:57:48 -0000 1.98 +++ usbdi.c 8 Nov 2018 16:31:13 -0000 @@ -657,19 +657,20 @@ usbd_set_interface(struct usbd_interface { usb_device_request_t req; usbd_status err; - void *endpoints; + struct usbd_endpoint *endpoints; + int nendpt; if (LIST_FIRST(&iface->pipes) != 0) return (USBD_IN_USE); endpoints = iface->endpoints; + nendpt = iface->nendpt; err = usbd_fill_iface_data(iface->device, iface->index, altidx); if (err) return (err); /* new setting works, we can free old endpoints */ - if (endpoints != NULL) - free(endpoints, M_USB, 0); + free(endpoints, M_USB, nendpt * sizeof(*endpoints)); #ifdef DIAGNOSTIC if (iface->idesc == NULL) { Index: usbdivar.h =================================================================== RCS file: /cvs/src/sys/dev/usb/usbdivar.h,v retrieving revision 1.75 diff -u -p -r1.75 usbdivar.h --- usbdivar.h 1 May 2018 18:14:46 -0000 1.75 +++ usbdivar.h 8 Nov 2018 16:09:32 -0000 @@ -173,7 +173,8 @@ struct usbd_interface { struct usbd_endpoint *endpoints; void *priv; LIST_HEAD(, usbd_pipe) pipes; - u_int8_t claimed; + uint8_t claimed; + uint8_t nendpt; }; struct usbd_pipe {