Re: [PATCH] usb: dwc2: debugfs: fix memory leak of hsotg->regset

[Thinh Nguyen]

On Fri, Aug 07, 2026, Huang Wei wrote:
> hsotg->regset is allocated in dwc2_debugfs_init() using devm_kzalloc()
> but is never explicitly freed. While devres would eventually reclaim
> the memory, the regset is logically owned by the debugfs lifetime:
> dwc2_debugfs_exit() only removes the debugfs directory and leaves
> hsotg->regset dangling.
> 
> Switch to kzalloc() and free it explicitly in dwc2_debugfs_exit(),
> mirroring the equivalent fix already applied to dwc3 in commit
> e6bdf8195b4a ("usb: dwc3: fix memory leak of dwc->regset"). Also set
> the pointer to NULL after freeing to avoid a stale dangling pointer.

This 2nd paragraph sounds as if dwc3 did the same thing (changing
devm_kzalloc -> kzalloc). The mentioned commit is solving a separate
problem. That's misleading. Please remove this paragraph.

> 
> Reported-by: kakapapa2 <kakapapa2@xxxxxxxxx>
> Closes: https://urldefense.com/v3/__https://bugzilla.kernel.org/show_bug.cgi?id=219977__;!!A4F2R9G_pg!fZ_fOd6cc_gIWYTIuT9N9wCV-tBbojEsj1lrFMFZZHpEGRwC2EcvZzNOTtFndJI6z1GZYyQQQmn8L4pqnvVgioYL$ 

The report and the commit message are somewhat misleading because regset
is currently allocated with devm_kzalloc(), so it is not expected to be
freed from dwc2_debugfs_exit(). The issue is really about the allocation
lifetime with the debugfs lifetime rather than fixing a memory leak in
the existing implementation.

But overall, IMO, this change is good to have. If you send a v2 with a
fix up commit message and send a v2, you can add this:

Reviewed-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>

BR,
Thinh

> Signed-off-by: Huang Wei <huangwei@xxxxxxxxxx>
> ---
>  drivers/usb/dwc2/debugfs.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/dwc2/debugfs.c b/drivers/usb/dwc2/debugfs.c
> index 3116ac72747f..2ecbf6523aaa 100644
> --- a/drivers/usb/dwc2/debugfs.c
> +++ b/drivers/usb/dwc2/debugfs.c
> @@ -9,6 +9,7 @@
>  #include <linux/spinlock.h>
>  #include <linux/debugfs.h>
>  #include <linux/seq_file.h>
> +#include <linux/slab.h>
>  #include <linux/uaccess.h>
>  
>  #include "core.h"
> @@ -787,8 +788,7 @@ int dwc2_debugfs_init(struct dwc2_hsotg *hsotg)
>  	/* Add gadget debugfs nodes */
>  	dwc2_hsotg_create_debug(hsotg);
>  
> -	hsotg->regset = devm_kzalloc(hsotg->dev, sizeof(*hsotg->regset),
> -								GFP_KERNEL);
> +	hsotg->regset = kzalloc_obj(*hsotg->regset, GFP_KERNEL);
>  	if (!hsotg->regset) {
>  		ret = -ENOMEM;
>  		goto err;
> @@ -810,4 +810,6 @@ void dwc2_debugfs_exit(struct dwc2_hsotg *hsotg)
>  {
>  	debugfs_remove_recursive(hsotg->debug_root);
>  	hsotg->debug_root = NULL;
> +	kfree(hsotg->regset);
> +	hsotg->regset = NULL;
>  }
> -- 
> 2.25.1
> 
>