diff options
| author | Richard Habeeb <richard.habeeb@gmail.com> | 2023-07-24 15:45:25 -0400 |
|---|---|---|
| committer | Marek Vasut <marex@denx.de> | 2023-07-27 03:59:38 +0200 |
| commit | 3aba92c9dd2302a91b56d49791041766dcc7dfeb (patch) | |
| tree | 372ab280a804bbd9ef84f3a882246d3dc19fe41a /drivers/usb | |
| parent | 15cba56dc80092c397be8bbe086abb926808857c (diff) | |
| download | u-boot-3aba92c9dd2302a91b56d49791041766dcc7dfeb.tar.gz u-boot-3aba92c9dd2302a91b56d49791041766dcc7dfeb.tar.bz2 u-boot-3aba92c9dd2302a91b56d49791041766dcc7dfeb.zip | |
usb: xhci: Fix double free on failure
drivers/core/device.c will call `device_free()` after xhci_register
already frees the private device data. This can cause a crash later
during the boot process, observed on aarch64 RPi4b as a synchronous
exception. All callers of xhci_register use priv_auto, so this won't
lead to memory leaks.
Signed-off-by: Richard Habeeb <richard.habeeb@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/host/xhci.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 9e33c5d855..5cacf0769e 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1418,7 +1418,6 @@ int xhci_register(struct udevice *dev, struct xhci_hccr *hccr, return 0; err: - free(ctrl); debug("%s: failed, ret=%d\n", __func__, ret); return ret; } |