The dwc3_free_one_event_buffer() function incorrectly called free()
on event buffer structures allocated with devm_kzalloc(). This
caused heap corruption and a synchronous abort when exiting
fastboot mode via "fastboot continue".
Device-managed memory is automatically freed when the device is
removed, so manual deallocation causes the heap allocator to access
corrupted metadata.
Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer
cleanup")
Signed-off-by: Balaji Selvanathan <[email protected]>
---
Changes in v3:
- Move Fixes tag to commit footer in commit description
- Link to v2:
https://lore.kernel.org/u-boot/[email protected]/
Changes in v2:
- Added Fixes tag in commit description
- Link to v1:
https://lore.kernel.org/u-boot/[email protected]/
---
drivers/usb/dwc3/core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 0dee14c8b59..be198041f08 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
struct dwc3_event_buffer *evt)
{
dma_free_coherent(evt->buf);
- free(evt);
}
/**
---
base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c
change-id: 20260507-usb-b0dfbffe0946
Best regards,
--
Balaji Selvanathan <[email protected]>
