Hi Balaji, Thank you for the patch.
On Thu, May 07, 2026 at 10:06, Balaji Selvanathan <[email protected]> wrote: > The dwc3_free_one_event_buffer() function incorrectly called free() > on event buffer structures allocated with devm_kzalloc(). This > caused heap corruption and a synchronous abort when exiting > fastboot mode via "fastboot continue". > > Device-managed memory is automatically freed when the device is > removed, so manual deallocation causes the heap allocator to access > corrupted metadata. > > Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer > cleanup") > > Signed-off-by: Balaji Selvanathan <[email protected]> Reviewed-by: Mattijs Korpershoek <[email protected]> Marek, I'm assuming you will pick this up. If you want me to take it instead, let me know. > --- > Changes in v2: > - Added Fixes tag in commit description > - Link to v1: > https://lore.kernel.org/u-boot/[email protected]/ > --- > drivers/usb/dwc3/core.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c > index 0dee14c8b59..be198041f08 100644 > --- a/drivers/usb/dwc3/core.c > +++ b/drivers/usb/dwc3/core.c > @@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc, > struct dwc3_event_buffer *evt) > { > dma_free_coherent(evt->buf); > - free(evt); > } > > /** > > --- > base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c > change-id: 20260507-usb-34b404ff063a > > Best regards, > -- > Balaji Selvanathan <[email protected]>
