[PATCH v2] usb: dwc3: core: fix memory leaks in event buffer cleanup

[Marek Vasut]

On 5/8/26 1:01 PM, Alexey Charkov wrote:
> On Fri, May 8, 2026 at 2:45 PM Gurumoorthy Santhakumar
> <gurumoorthy.santhakumar at oss.qualcomm.com> wrote:
>>
>> In dwc3_free_one_event_buffer(), only the DMA buffer (evt->buf) was
>> being freed via dma_free_coherent(), but the evt structure itself was
>> never explicitly freed, causing a memory leak.
>>
>> In dwc3_free_event_buffers(), the ev_buffs pointer array allocated
>> with memalign() was never freed after iterating and releasing all
>> individual event buffers, causing another memory leak.
>>
>> Fix both leaks by freeing the evt struct in
>> dwc3_free_one_event_buffer() and freeing dwc->ev_buffs in
>> dwc3_free_event_buffers() after all entries have been released.
>>
>> Signed-off-by: Gurumoorthy Santhakumar <gurumoorthy.santhakumar at oss.qualcomm.com>
>> ---
>> Changes in V2:
>> - Removed redundant NULL check before free
>> - Removed NULL assignment to the pointer after free
>> - Link to V1:
>> https://lore.kernel.org/u-boot/20260414055013.2978223-1-gurumoorthy.santhakumar@oss.qualcomm.com/
>> ---
>> ---
>>   drivers/usb/dwc3/core.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
>> index 6f22b9232ba..65c4d1a4e6f 100644
>> --- a/drivers/usb/dwc3/core.c
>> +++ b/drivers/usb/dwc3/core.c
>> @@ -206,6 +206,7 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
>>                  struct dwc3_event_buffer *evt)
>>   {
>>          dma_free_coherent(evt->buf);
>> +       free(evt);
> 
> Hi Gurumoorthy,
> 
> evt is allocated using devm_kzalloc, so this change introduces a
> double-free causing a crash when tearing down a USB gadget mode
> session on my Rockchip RK3576 board:
Can you please also provide a Tested-by: for this fix ?