Commit 44bfb43f authored by Stephen Warren's avatar Stephen Warren Committed by Tom Rini
Browse files

usb: gadget: don't leak configs when unbinding

By the time g_dnl_unbind() is run, cdev->config has been set to NULL,
so the free() there does nothing, and the config struct is leaked.
Equally, struct usb_gadget contains a linked list of config structs, so
the code should iterate over them all and free each one, rather than
freeing one particular config struct.

composite_unbind() already iterates over the list of config structs, and
unlinks each from the linked list. Fix this loop to free() each struct as
it's unlinked and otherwise forgotten.
Signed-off-by: default avatarStephen Warren <>
Acked-by: default avatarLukasz Majewski <>
Tested-by: default avatarLukasz Majewski <>
parent 0a04ed86
...@@ -948,6 +948,7 @@ static void composite_unbind(struct usb_gadget *gadget) ...@@ -948,6 +948,7 @@ static void composite_unbind(struct usb_gadget *gadget)
debug("unbind config '%s'/%p\n", c->label, c); debug("unbind config '%s'/%p\n", c->label, c);
c->unbind(c); c->unbind(c);
} }
} }
if (composite->unbind) if (composite->unbind)
composite->unbind(cdev); composite->unbind(cdev);
...@@ -93,8 +93,6 @@ static int g_dnl_unbind(struct usb_composite_dev *cdev) ...@@ -93,8 +93,6 @@ static int g_dnl_unbind(struct usb_composite_dev *cdev)
{ {
struct usb_gadget *gadget = cdev->gadget; struct usb_gadget *gadget = cdev->gadget;
cdev->config = NULL;
debug("%s: calling usb_gadget_disconnect for " debug("%s: calling usb_gadget_disconnect for "
"controller '%s'\n", __func__, gadget->name); "controller '%s'\n", __func__, gadget->name);
usb_gadget_disconnect(gadget); usb_gadget_disconnect(gadget);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment