On Thu, May 07, 2026 at 10:06, Balaji Selvanathan
<[email protected]> wrote:
> The dwc3_free_one_event_buffer() function incorrectly called free()
> on event buffer structures allocated with devm_kzalloc(). This
> caused heap corruption and a synchronous abort when exiting
> fastboot mode via "fastboot continue".
>
> Device-managed memory is automatically freed when the device is
> removed, so manual deallocation causes the heap allocator to access
> corrupted metadata.
>
> Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer
> cleanup")
>
> Signed-off-by: Balaji Selvanathan <[email protected]>
Ah, and I missed a nitpick. Fixes should be part of the commit footer.
Same block as in the Signed-off-by:
See:
https://docs.kernel.org/process/submitting-patches.html#using-reported-by-tested-by-reviewed-by-suggested-by-and-fixes
> ---
> Changes in v2:
> - Added Fixes tag in commit description
> - Link to v1:
> https://lore.kernel.org/u-boot/[email protected]/
> ---
> drivers/usb/dwc3/core.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index 0dee14c8b59..be198041f08 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
> struct dwc3_event_buffer *evt)
> {
> dma_free_coherent(evt->buf);
> - free(evt);
> }
>
> /**
>
> ---
> base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c
> change-id: 20260507-usb-34b404ff063a
>
> Best regards,
> --
> Balaji Selvanathan <[email protected]>
