From 2cadf783fdb491f67efa7c423957226968efa24e Mon Sep 17 00:00:00 2001 From: ziggurat29 Date: Thu, 7 Jul 2016 12:02:23 -0500 Subject: [PATCH] cdcacm_unbind leaks write request objects. This arises due to freeing the bulk IN endpoint before the loop that frees the requests via cdcasm_freereq. That function checks the parameters and skips the freeing if either is NULL. Freeing the bulk IN enpoint will cause the first param to be NULL, thereby bypassing the free operation. To fix, I moved the release of the bulk IN endpoint until after to loop (much as was the case for the OUT and read requests, which did not exhibit the problem). --- drivers/usbdev/cdcacm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/usbdev/cdcacm.c b/drivers/usbdev/cdcacm.c index 48dbdf5cb0b..28d498363b0 100644 --- a/drivers/usbdev/cdcacm.c +++ b/drivers/usbdev/cdcacm.c @@ -1162,14 +1162,6 @@ static void cdcacm_unbind(FAR struct usbdevclass_driver_s *driver, priv->epintin = NULL; } - /* Free the bulk IN endpoint */ - - if (priv->epbulkin) - { - DEV_FREEEP(dev, priv->epbulkin); - priv->epbulkin = NULL; - } - /* Free the pre-allocated control request */ if (priv->ctrlreq != NULL) @@ -1220,6 +1212,14 @@ static void cdcacm_unbind(FAR struct usbdevclass_driver_s *driver, DEBUGASSERT(priv->nwrq == 0); leave_critical_section(flags); + /* Free the bulk IN endpoint */ + + if (priv->epbulkin) + { + DEV_FREEEP(dev, priv->epbulkin); + priv->epbulkin = NULL; + } + /* Clear out all data in the circular buffer */ priv->serdev.xmit.head = 0;