From: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
Date: Thu, 7 May 2026 15:20:35 +0000 (+0530)
Subject: usb: dwc3: Fix crash on fastboot exit due to incorrect memory free
X-Git-Tag: v2026.07-rc2~6^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc8195b13b12cde3192978df64fd8bfac0f591f4;p=thirdparty%2Fu-boot.git

usb: dwc3: Fix crash on fastboot exit due to incorrect memory free

The dwc3_free_one_event_buffer() function incorrectly called free()
on event buffer structures allocated with devm_kzalloc(). This
caused heap corruption and a synchronous abort when exiting
fastboot mode via "fastboot continue".

Device-managed memory is automatically freed when the device is
removed, so manual deallocation causes the heap allocator to access
corrupted metadata.

Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")
Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
Reviewed-by: Marek Vasut <marek.vasut+usb@mailbox.org>
---

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 0dee14c8b59..be198041f08 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc,
 		struct dwc3_event_buffer *evt)
 {
 	dma_free_coherent(evt->buf);
-	free(evt);
 }
 
 /**