USB: rmnet: Free device context memory only during cleanup
Device context is currently allocated only once during
initialization and it gets freed during function unbind.
This causes memory corruption issue as device context is
accessed again after compostion switch.
Fix this issue by freeing the memory only at the time of
cleaning up the function driver resources.
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
diff --git a/drivers/usb/gadget/f_rmnet.c b/drivers/usb/gadget/f_rmnet.c
index dcb43a2..cf7a798 100644
--- a/drivers/usb/gadget/f_rmnet.c
+++ b/drivers/usb/gadget/f_rmnet.c
@@ -292,7 +292,6 @@
frmnet_free_req(dev->notify, dev->notify_req);
kfree(f->name);
- kfree(dev);
}
static void frmnet_disable(struct usb_function *f)
@@ -715,7 +714,6 @@
pr_err("%s: usb add function failed: %d\n",
__func__, status);
kfree(f->name);
- kfree(dev);
return status;
}
@@ -724,6 +722,16 @@
return status;
}
+static void frmnet_cleanup(void)
+{
+ int i;
+
+ for (i = 0; i < nr_rmnet_ports; i++)
+ kfree(rmnet_ports[i].port);
+
+ nr_rmnet_ports = 0;
+}
+
static int frmnet_init_port(int instances)
{
int i;
@@ -732,6 +740,12 @@
pr_debug("%s: instances :%d\n", __func__, instances);
+ if (instances > NR_RMNET_PORTS) {
+ pr_err("%s: Max-%d instances supported\n", __func__,
+ NR_RMNET_PORTS);
+ return -EINVAL;
+ }
+
for (i = 0; i < instances; i++) {
dev = kzalloc(sizeof(struct f_rmnet), GFP_KERNEL);
if (!dev) {