diff options
| author | Huang Wei <huangwei@kylinos.cn> | 2026-09-09 10:10:14 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-10 15:42:17 +0200 |
| commit | 5f56bc090804559f56e4a1fd950ae2a24cf36518 (patch) | |
| tree | 0d1e2ec02aefde9b27567a5b8761200bd2d6ea0d | |
| parent | 44969e9a46ff678df0215ba0caab5590675ff8ea (diff) | |
| download | linux-next-5f56bc090804559f56e4a1fd950ae2a24cf36518.tar.gz linux-next-5f56bc090804559f56e4a1fd950ae2a24cf36518.zip | |
usb: dwc2: debugfs: fix memory leak of hsotg->regset
hsotg->regset is allocated in dwc2_debugfs_init() using devm_kzalloc(),
which ties its lifetime to the device (struct dwc2_hsotg) rather than
to the debugfs entries it serves. dwc2_debugfs_exit() removes the
debugfs directory but leaves hsotg->regset allocated until the device
itself is removed, so the pointer dangles for the remainder of the
device lifetime.
Switch to kzalloc() and free it explicitly in dwc2_debugfs_exit() so
the regset lifetime matches the debugfs lifetime. Set the pointer to
NULL after freeing to avoid a stale dangling pointer.
Reported-by: kakapapa2 <kakapapa2@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219977
Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Huang Wei <huangwei@kylinos.cn>
Link: https://patch.msgid.link/20260909021014.906548-1-huangwei@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/dwc2/debugfs.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/usb/dwc2/debugfs.c b/drivers/usb/dwc2/debugfs.c index 3116ac72747f..2ecbf6523aaa 100644 --- a/drivers/usb/dwc2/debugfs.c +++ b/drivers/usb/dwc2/debugfs.c @@ -9,6 +9,7 @@ #include <linux/spinlock.h> #include <linux/debugfs.h> #include <linux/seq_file.h> +#include <linux/slab.h> #include <linux/uaccess.h> #include "core.h" @@ -787,8 +788,7 @@ int dwc2_debugfs_init(struct dwc2_hsotg *hsotg) /* Add gadget debugfs nodes */ dwc2_hsotg_create_debug(hsotg); - hsotg->regset = devm_kzalloc(hsotg->dev, sizeof(*hsotg->regset), - GFP_KERNEL); + hsotg->regset = kzalloc_obj(*hsotg->regset, GFP_KERNEL); if (!hsotg->regset) { ret = -ENOMEM; goto err; @@ -810,4 +810,6 @@ void dwc2_debugfs_exit(struct dwc2_hsotg *hsotg) { debugfs_remove_recursive(hsotg->debug_root); hsotg->debug_root = NULL; + kfree(hsotg->regset); + hsotg->regset = NULL; } |