usb:composite: data abort on second ums launch

[Mattijs Korpershoek]

Hi Zixun,

On jeu., mars 27, 2025 at 14:46, Mattijs Korpershoek <mkorpershoek at baylibre.com> wrote:

> Hi Zixun, Marek,
>
> On lun., mars 24, 2025 at 18:40, Mattijs Korpershoek <mkorpershoek at baylibre.com> wrote:
>
>> Hi Zixun,
>>
>> On lun., mars 24, 2025 at 18:33, Zixun LI <admin at hifiphile.com> wrote:
>>
>> resetting ...
>
> [...]
>
>>
>>>
>>> Each time when ums is called 2*FSG_BUFLEN, 256kB buffer is allocated
>>> and it seems not
>>> freed as fsg_common_release() is not called.
>
> There are quite a few things that are wrong in
> drivers/usb/gadget/f_mass_storage.c
>
> 1. The "Synchronous Abort" exception happens because we call
>    kfree(common->luns); and common->luns is not allocated via
>    malloc/kmalloc.
>
> 2. We use a kref member that's unused and can be removed
>
> 3. There is a memory leak (as reported by Zixun) when unbind() is
>    called. We should call fsg_common_release().
>
> I will send a series to fix this.

Series send out here:
https://lore.kernel.org/u-boot/20250328-ums-gadget-leak-v1-0-3b677db99bde@baylibre.com

Available on patchwork:
https://patchwork.ozlabs.org/project/uboot/patch/20250328-ums-gadget-leak-v1-0-3b677db99bde@baylibre.com/

If you could have a look and test it yourself, that would be greatly
appreciated.

If doing so, you can reply to the above thread with: "Tested-by: Name <email>"

>
> Zixun, thanks again for reporting this and helping me reproduce!
>
> Mattijs
>
>>>
>>> Zixun