[PATCH v2] usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

[PATCH v2] usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

[Balaji Selvanathan]

The dwc3_free_one_event_buffer() function incorrectly called free()
on event buffer structures allocated with devm_kzalloc(). This
caused heap corruption and a synchronous abort when exiting
fastboot mode via "fastboot continue".

Device-managed memory is automatically freed when the device is
removed, so manual deallocation causes the heap allocator to access
corrupted metadata.

Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v2:
- Added Fixes tag in commit description
- Link to v1: https://lore.kernel.org/u-boot/20260506-usb-v1-1-e0f426bb1e42@oss.qualcomm.com/
---
 drivers/usb/dwc3/core.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 0dee14c8b59..be198041f08 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
 		struct dwc3_event_buffer *evt)
 {
 	dma_free_coherent(evt->buf);
-	free(evt);
 }
 
 /**

---
base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c
change-id: 20260507-usb-34b404ff063a

Best regards,
-- 
Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

Re: [PATCH v2] usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

[Mattijs Korpershoek]

Hi Balaji,

Thank you for the patch.

On Thu, May 07, 2026 at 10:06, Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com> wrote:

> The dwc3_free_one_event_buffer() function incorrectly called free()
> on event buffer structures allocated with devm_kzalloc(). This
> caused heap corruption and a synchronous abort when exiting
> fastboot mode via "fastboot continue".
>
> Device-managed memory is automatically freed when the device is
> removed, so manual deallocation causes the heap allocator to access
> corrupted metadata.
>
> Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")
>
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

Marek, I'm assuming you will pick this up.
If you want me to take it instead, let me know.

> ---
> Changes in v2:
> - Added Fixes tag in commit description
> - Link to v1: https://lore.kernel.org/u-boot/20260506-usb-v1-1-e0f426bb1e42@oss.qualcomm.com/
> ---
>  drivers/usb/dwc3/core.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index 0dee14c8b59..be198041f08 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
>  		struct dwc3_event_buffer *evt)
>  {
>  	dma_free_coherent(evt->buf);
> -	free(evt);
>  }
>  
>  /**
>
> ---
> base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c
> change-id: 20260507-usb-34b404ff063a
>
> Best regards,
> -- 
> Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

Re: [PATCH v2] usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

[Mattijs Korpershoek]

On Thu, May 07, 2026 at 10:06, Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com> wrote:

> The dwc3_free_one_event_buffer() function incorrectly called free()
> on event buffer structures allocated with devm_kzalloc(). This
> caused heap corruption and a synchronous abort when exiting
> fastboot mode via "fastboot continue".
>
> Device-managed memory is automatically freed when the device is
> removed, so manual deallocation causes the heap allocator to access
> corrupted metadata.
>
> Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")
>
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

Ah, and I missed a nitpick. Fixes should be part of the commit footer.
Same block as in the Signed-off-by:

See: https://docs.kernel.org/process/submitting-patches.html#using-reported-by-tested-by-reviewed-by-suggested-by-and-fixes

> ---
> Changes in v2:
> - Added Fixes tag in commit description
> - Link to v1: https://lore.kernel.org/u-boot/20260506-usb-v1-1-e0f426bb1e42@oss.qualcomm.com/
> ---
>  drivers/usb/dwc3/core.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index 0dee14c8b59..be198041f08 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
>  		struct dwc3_event_buffer *evt)
>  {
>  	dma_free_coherent(evt->buf);
> -	free(evt);
>  }
>  
>  /**
>
> ---
> base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c
> change-id: 20260507-usb-34b404ff063a
>
> Best regards,
> -- 
> Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

Re: [PATCH v2] usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

[Marek Vasut]

On 5/7/26 10:45 AM, Mattijs Korpershoek wrote:
> Hi Balaji,
> 
> Thank you for the patch.
> 
> On Thu, May 07, 2026 at 10:06, Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com> wrote:
> 
>> The dwc3_free_one_event_buffer() function incorrectly called free()
>> on event buffer structures allocated with devm_kzalloc(). This
>> caused heap corruption and a synchronous abort when exiting
>> fastboot mode via "fastboot continue".
>>
>> Device-managed memory is automatically freed when the device is
>> removed, so manual deallocation causes the heap allocator to access
>> corrupted metadata.
>>
>> Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> 
> Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
> 
> Marek, I'm assuming you will pick this up.
> If you want me to take it instead, let me know.
I'll pick up V3 once the nitpick is addressed.

Re: [PATCH v2] usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

[Balaji Selvanathan]

On 5/7/2026 2:21 PM, Mattijs Korpershoek wrote:
> On Thu, May 07, 2026 at 10:06, Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com> wrote:
>
>> The dwc3_free_one_event_buffer() function incorrectly called free()
>> on event buffer structures allocated with devm_kzalloc(). This
>> caused heap corruption and a synchronous abort when exiting
>> fastboot mode via "fastboot continue".
>>
>> Device-managed memory is automatically freed when the device is
>> removed, so manual deallocation causes the heap allocator to access
>> corrupted metadata.
>>
>> Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> Ah, and I missed a nitpick. Fixes should be part of the commit footer.
> Same block as in the Signed-off-by:
>
> See: https://docs.kernel.org/process/submitting-patches.html#using-reported-by-tested-by-reviewed-by-suggested-by-and-fixes

Hi,

Thanks for the feedback; Pls find respin here: 
https://lore.kernel.org/u-boot/20260507-usb-v3-1-402b37fc2154@oss.qualcomm.com/

Regards,

Balaji

>> ---
>> Changes in v2:
>> - Added Fixes tag in commit description
>> - Link to v1: https://lore.kernel.org/u-boot/20260506-usb-v1-1-e0f426bb1e42@oss.qualcomm.com/
>> ---
>>   drivers/usb/dwc3/core.c | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
>> index 0dee14c8b59..be198041f08 100644
>> --- a/drivers/usb/dwc3/core.c
>> +++ b/drivers/usb/dwc3/core.c
>> @@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
>>   		struct dwc3_event_buffer *evt)
>>   {
>>   	dma_free_coherent(evt->buf);
>> -	free(evt);
>>   }
>>   
>>   /**
>>
>> ---
>> base-commit: 3cdd19089f1b1b7cd08530f33ff4708abcfd426c
>> change-id: 20260507-usb-34b404ff063a
>>
>> Best regards,
>> -- 
>> Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>