usb:composite: data abort on second ums launch

[Mattijs Korpershoek]

Hi Zixun, Marek,

On lun., mars 24, 2025 at 18:40, Mattijs Korpershoek <mkorpershoek at baylibre.com> wrote:

> Hi Zixun,
>
> On lun., mars 24, 2025 at 18:33, Zixun LI <admin at hifiphile.com> wrote:
>
> resetting ...

[...]

>
>>
>> Each time when ums is called 2*FSG_BUFLEN, 256kB buffer is allocated
>> and it seems not
>> freed as fsg_common_release() is not called.

There are quite a few things that are wrong in
drivers/usb/gadget/f_mass_storage.c

1. The "Synchronous Abort" exception happens because we call
   kfree(common->luns); and common->luns is not allocated via
   malloc/kmalloc.

2. We use a kref member that's unused and can be removed

3. There is a memory leak (as reported by Zixun) when unbind() is
   called. We should call fsg_common_release().

I will send a series to fix this.

Zixun, thanks again for reporting this and helping me reproduce!

Mattijs

>>
>> Zixun