[PATCH] xhci_register: Fix double free on failure

Richard Habeeb richard.habeeb at gmail.com
Mon Jul 24 21:45:25 CEST 2023

drivers/core/device.c will call `device_free()` after xhci_register
already frees the private device data. This can cause a crash later
during the boot process, observed on aarch64 RPi4b as a synchronous
exception. All callers of xhci_register use priv_auto, so this won't
lead to memory leaks.

Signed-off-by: Richard Habeeb <richard.habeeb at gmail.com>

 drivers/usb/host/xhci.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 9e33c5d855..5cacf0769e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1418,7 +1418,6 @@ int xhci_register(struct udevice *dev, struct
xhci_hccr *hccr,

  return 0;
- free(ctrl);
  debug("%s: failed, ret=%d\n", __func__, ret);
  return ret;

More information about the U-Boot mailing list