[PATCH v2] usb: dwc3: core: fix memory leaks in event buffer cleanup

[Mattijs Korpershoek]

Hi Alexey,

Thank you for reporting this issue.

On Fri, May 08, 2026 at 13:26, Marek Vasut <marex at nabladev.com> wrote:

> On 5/8/26 1:01 PM, Alexey Charkov wrote:
>> On Fri, May 8, 2026 at 2:45 PM Gurumoorthy Santhakumar
>> <gurumoorthy.santhakumar at oss.qualcomm.com> wrote:
>>>
>>> In dwc3_free_one_event_buffer(), only the DMA buffer (evt->buf) was
>>> being freed via dma_free_coherent(), but the evt structure itself was
>>> never explicitly freed, causing a memory leak.
>>>
>>> In dwc3_free_event_buffers(), the ev_buffs pointer array allocated
>>> with memalign() was never freed after iterating and releasing all
>>> individual event buffers, causing another memory leak.
>>>
>>> Fix both leaks by freeing the evt struct in
>>> dwc3_free_one_event_buffer() and freeing dwc->ev_buffs in
>>> dwc3_free_event_buffers() after all entries have been released.
>>>
>>> Signed-off-by: Gurumoorthy Santhakumar <gurumoorthy.santhakumar at oss.qualcomm.com>
>>> ---
>>> Changes in V2:
>>> - Removed redundant NULL check before free
>>> - Removed NULL assignment to the pointer after free
>>> - Link to V1:
>>> https://lore.kernel.org/u-boot/20260414055013.2978223-1-gurumoorthy.santhakumar@oss.qualcomm.com/
>>> ---
>>> ---
>>>   drivers/usb/dwc3/core.c | 3 +++
>>>   1 file changed, 3 insertions(+)
>>>
>>> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
>>> index 6f22b9232ba..65c4d1a4e6f 100644
>>> --- a/drivers/usb/dwc3/core.c
>>> +++ b/drivers/usb/dwc3/core.c
>>> @@ -206,6 +206,7 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
>>>                  struct dwc3_event_buffer *evt)
>>>   {
>>>          dma_free_coherent(evt->buf);
>>> +       free(evt);
>> 
>> Hi Gurumoorthy,
>> 
>> evt is allocated using devm_kzalloc, so this change introduces a
>> double-free causing a crash when tearing down a USB gadget mode
>> session on my Rockchip RK3576 board:
> Can you please also provide a Tested-by: for this fix ?

As mentioned by Marek, we already have a fix in review for the problem
you have reported.

It's available here:
https://lore.kernel.org/u-boot/20260507-usb-v3-1-402b37fc2154@oss.qualcomm.com/

Can you please test the above patch and reply with a Tested-by: if it
fixes your problem?