* [PATCH] usb: gadget: bdc: Fix potential ep0 BD table leak
@ 2026-11-10 14:32 Guangshuo Li
2026-11-10 18:02 ` Florian Fainelli
0 siblings, 1 reply; 2+ messages in thread
From: Guangshuo Li @ 2026-11-10 14:32 UTC (permalink / raw)
To: Justin Chen, Al Cooper, Broadcom internal kernel review list,
Neill Kapron, Greg Kroah-Hartman
Cc: linux-usb, linux-kernel
The ep0 BD list is kept across disconnects, and ep0 does not have
BDC_EP_ENABLED set after allocation. Consequently bdc_free_ep() skips
its tables before the BD table pool is destroyed.
Free an allocated ep0 BD list during final endpoint teardown.
This issue was found by our static analysis tool under development.
Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
drivers/usb/gadget/udc/bdc/bdc_ep.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index a7a22e5ec47b..db176636355d 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -908,7 +908,8 @@ void bdc_free_ep(struct bdc *bdc)
if (!ep)
continue;
- if (ep->flags & BDC_EP_ENABLED)
+ if ((ep->flags & BDC_EP_ENABLED) ||
+ (epnum == 1 && ep->bd_list.num_tabs))
ep_bd_list_free(ep, ep->bd_list.num_tabs);
/* ep0 is not in this gadget list */
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] usb: gadget: bdc: Fix potential ep0 BD table leak
2026-11-10 14:32 [PATCH] usb: gadget: bdc: Fix potential ep0 BD table leak Guangshuo Li
@ 2026-11-10 18:02 ` Florian Fainelli
0 siblings, 0 replies; 2+ messages in thread
From: Florian Fainelli @ 2026-11-10 18:02 UTC (permalink / raw)
To: Guangshuo Li, Justin Chen, Al Cooper,
Broadcom internal kernel review list, Neill Kapron,
Greg Kroah-Hartman
Cc: linux-usb, linux-kernel
On 11/10/26 06:32, Guangshuo Li wrote:
> The ep0 BD list is kept across disconnects, and ep0 does not have
> BDC_EP_ENABLED set after allocation. Consequently bdc_free_ep() skips
> its tables before the BD table pool is destroyed.
>
> Free an allocated ep0 BD list during final endpoint teardown.
>
> This issue was found by our static analysis tool under development.
>
> Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-10 18:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-10 14:32 [PATCH] usb: gadget: bdc: Fix potential ep0 BD table leak Guangshuo Li
2026-11-10 18:02 ` Florian Fainelli
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®