From: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
To: Justin Chen <justin.chen@broadcom.com>,
Al Cooper <alcooperx@gmail.com>,
Broadcom internal kernel review list
<bcm-kernel-feedback-list@broadcom.com>,
Neill Kapron <nkapron@google.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] usb: gadget: bdc: Fix potential ep0 BD table leak
Date: Tue, 10 Nov 2026 22:32:30 +0800 [thread overview]
Message-ID: <20261110-9f141e6bc8-usb-bdc@mail.sdu.edu.cn> (raw)
The ep0 BD list is kept across disconnects, and ep0 does not have
BDC_EP_ENABLED set after allocation. Consequently bdc_free_ep() skips
its tables before the BD table pool is destroyed.
Free an allocated ep0 BD list during final endpoint teardown.
This issue was found by our static analysis tool under development.
Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
drivers/usb/gadget/udc/bdc/bdc_ep.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index a7a22e5ec47b..db176636355d 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -908,7 +908,8 @@ void bdc_free_ep(struct bdc *bdc)
if (!ep)
continue;
- if (ep->flags & BDC_EP_ENABLED)
+ if ((ep->flags & BDC_EP_ENABLED) ||
+ (epnum == 1 && ep->bd_list.num_tabs))
ep_bd_list_free(ep, ep->bd_list.num_tabs);
/* ep0 is not in this gadget list */
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
reply other threads:[~2026-11-10 14:32 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261110-9f141e6bc8-usb-bdc@mail.sdu.edu.cn \
--to=liguangshuo@mail.sdu.edu.cn \
--cc=alcooperx@gmail.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=gregkh@linuxfoundation.org \
--cc=justin.chen@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=nkapron@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®