diff options
| author | Ralph Siemsen <ralph.siemsen@linaro.org> | 2019-06-28 10:42:02 -0400 |
|---|---|---|
| committer | Marek Vasut <marex@denx.de> | 2019-08-08 11:35:02 +0200 |
| commit | fe876984a428cc0058bdb536ac948397762f3c0d (patch) | |
| tree | 7feab0606296d04c18801c3bce8a78af53746a06 /drivers/usb/gadget/f_dfu.c | |
| parent | ed3a37a248532367a264380762edf4757f2603f4 (diff) | |
usb: gadget: f_dfu.c: fix memory leak
dfu_prepare_function() allocates N+1 descriptor header structures,
the last one being the "DFU Functional Descriptor".
dfu_unbind() handles de-allocation, but fails to free the final
one (eg. "DFU Functional Descriptor"), leading to memory leak.
Fixed by incrementing counter, as in dfu_prepare_function().
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Diffstat (limited to 'drivers/usb/gadget/f_dfu.c')
| -rw-r--r-- | drivers/usb/gadget/f_dfu.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c index 30ece524a8..e27f146605 100644 --- a/drivers/usb/gadget/f_dfu.c +++ b/drivers/usb/gadget/f_dfu.c @@ -748,6 +748,7 @@ static void dfu_unbind(struct usb_configuration *c, struct usb_function *f) if (f_dfu->function) { i = alt_num; + i++; /* free DFU Functional Descriptor */ while (i) { free(f_dfu->function[--i]); f_dfu->function[i] = NULL; |