dfu_prepare_function() allocates N+1 descriptor header structures,
the last one being the "DFU Functional Descriptor".

dfu_unbind() handles de-allocation, but failes to free the final
one (eg. "DFU Functional Descriptor"), leading to memory leak.

Fixed by incrementing counter, as in dfu_prepare_function().

Signed-off-by: Ralph Siemsen <ralph.siem...@linaro.org>
---

Notes:
    The array of pointers allocated in dfu_prepare_function() is larger
    than necessary. For some reason it is N+2 when N+1 would suffice.
    Not a memory leak, so did not address in this commit.

 drivers/usb/gadget/f_dfu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 30ece524a8..e27f146605 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration *c, struct 
usb_function *f)
 
        if (f_dfu->function) {
                i = alt_num;
+               i++; /* free DFU Functional Descriptor */
                while (i) {
                        free(f_dfu->function[--i]);
                        f_dfu->function[i] = NULL;
-- 
2.17.1

_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
https://lists.denx.de/listinfo/u-boot

Reply via email to