From: Richard Habeeb <richard.habeeb@gmail.com>
Date: Mon, 24 Jul 2023 19:45:25 +0000 (-0400)
Subject: usb: xhci: Fix double free on failure
X-Git-Url: http://git.dujemihanovic.xyz/?a=commitdiff_plain;h=3aba92c9dd2302a91b56d49791041766dcc7dfeb;p=u-boot.git

usb: xhci: Fix double free on failure

drivers/core/device.c will call `device_free()` after xhci_register
already frees the private device data. This can cause a crash later
during the boot process, observed on aarch64 RPi4b as a synchronous
exception. All callers of xhci_register use priv_auto, so this won't
lead to memory leaks.

Signed-off-by: Richard Habeeb <richard.habeeb@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
---

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 9e33c5d855..5cacf0769e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1418,7 +1418,6 @@ int xhci_register(struct udevice *dev, struct xhci_hccr *hccr,
 
 	return 0;
 err:
-	free(ctrl);
 	debug("%s: failed, ret=%d\n", __func__, ret);
 	return ret;
 }