From 442ec18acdb46caa0501d75129846ed64a6d8c23 Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Tue, 2 Aug 2016 17:54:40 -0700 Subject: [PATCH] usb: gadget: f_cdev: Fix memory leak upon composition switch Driver allocates notify request in function bind() callback but frees it in function disable() callback. Upon composition switch adb daemon gets restarted causing function bind/unbind to happen twice. This results into allocating notify request memory twice and only freeing it once either upon disconnect or next composition switch. Fix the issue freeing memory in function unbind callback. Change-Id: I7716cff99b824b55e48aea57b9da91c16a8ecac1 Signed-off-by: Hemant Kumar --- drivers/usb/gadget/function/f_cdev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_cdev.c b/drivers/usb/gadget/function/f_cdev.c index 0a9a3afd72dd..85609eb84143 100644 --- a/drivers/usb/gadget/function/f_cdev.c +++ b/drivers/usb/gadget/function/f_cdev.c @@ -516,7 +516,6 @@ static void usb_cser_disable(struct usb_function *f) usb_cser_disconnect(port); usb_ep_disable(port->port_usb.notify); - usb_cser_free_req(port->port_usb.notify, port->port_usb.notify_req); port->port_usb.notify->driver_data = NULL; } @@ -807,7 +806,11 @@ static void cser_free_inst(struct usb_function_instance *fi) static void usb_cser_unbind(struct usb_configuration *c, struct usb_function *f) { + struct f_cdev *port = func_to_port(f); + usb_free_all_descriptors(f); + usb_cser_free_req(port->port_usb.notify, port->port_usb.notify_req); + port->port_usb.notify_req = NULL; } static int usb_cser_alloc_requests(struct usb_ep *ep, struct list_head *head,