From c8f68234422b8afb516fea2336b678750f10ba5b Mon Sep 17 00:00:00 2001 From: Francois Berder Date: Sat, 9 May 2026 19:22:41 +0200 Subject: usb: gadget: f_acm: Fix memory leak in acm_add If udc_device_get_by_index fails, the f_acm struct was not released. Free it before returning the error. Signed-off-by: Francois Berder Reviewed-by: Marek Vasut Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/BESP194MB2805271AD5DBE47B322F8DC3DA3A2@BESP194MB2805.EURP194.PROD.OUTLOOK.COM Signed-off-by: Mattijs Korpershoek --- drivers/usb/gadget/f_acm.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c index 8f7256069f5..b6c11d97a62 100644 --- a/drivers/usb/gadget/f_acm.c +++ b/drivers/usb/gadget/f_acm.c @@ -548,13 +548,11 @@ static int acm_add(struct usb_configuration *c) status = udc_device_get_by_index(0, &f_acm->udc); if (status) - return status; + goto err; status = usb_add_function(c, &f_acm->usb_function); - if (status) { - free(f_acm); - return status; - } + if (status) + goto err; buf_init(&f_acm->rx_buf, 2048); buf_init(&f_acm->tx_buf, 2048); @@ -562,6 +560,10 @@ static int acm_add(struct usb_configuration *c) if (!default_acm_function) default_acm_function = f_acm; + return 0; + +err: + free(f_acm); return status; } -- cgit v1.2.3 From 7f34bb50a59804f6ebe02c1f62b7b29093eb103c Mon Sep 17 00:00:00 2001 From: Zixun LI Date: Fri, 15 May 2026 12:05:41 +0200 Subject: usb: gadget: atmel: do not disable endpoints in reset_all_endpoints() Endpoints should not be disabled on bus reset inside UDC driver, otherwise a race condition will happen between gadget driver. Gadget driver will free the requests and disable endpoints in disconnect ops. Also remove outdated comment about it in usba_ep_disable(). Signed-off-by: Zixun LI Reviewed-by: Mattijs Korpershoek Fixes: 59310d1ecb9f ("usb: gadget: introduce 'enabled' flag in struct usb_ep") Link: https://patch.msgid.link/20260515-udc_ep-v2-1-cd335b4e62e4@hifiphile.com [mkorpershoek: removed empty newline between Fixes: and sob] Signed-off-by: Mattijs Korpershoek --- drivers/usb/gadget/atmel_usba_udc.c | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c index f7a92ded6da..a2eee2bca2c 100644 --- a/drivers/usb/gadget/atmel_usba_udc.c +++ b/drivers/usb/gadget/atmel_usba_udc.c @@ -289,10 +289,6 @@ static int usba_ep_disable(struct usb_ep *_ep) if (!ep->desc) { spin_unlock_irqrestore(&udc->lock, flags); - /* REVISIT because this driver disables endpoints in - * reset_all_endpoints() before calling disconnect(), - * most gadget drivers would trigger this non-error ... - */ if (udc->gadget.speed != USB_SPEED_UNKNOWN) DBG(DBG_ERR, "ep_disable: %s not enabled\n", ep->ep.name); @@ -571,20 +567,6 @@ static void reset_all_endpoints(struct usba_udc *udc) list_del_init(&req->queue); request_complete(ep, req, -ECONNRESET); } - - /* NOTE: normally, the next call to the gadget driver is in - * charge of disabling endpoints... usually disconnect(). - * The exception would be entering a high speed test mode. - * - * FIXME remove this code ... and retest thoroughly. - */ - list_for_each_entry(ep, &udc->gadget.ep_list, ep.ep_list) { - if (ep->desc) { - spin_unlock(&udc->lock); - usba_ep_disable(&ep->ep); - spin_lock(&udc->lock); - } - } } static struct usba_ep *get_ep_by_addr(struct usba_udc *udc, u16 wIndex) -- cgit v1.2.3