[PATCH] usb: gadget: bdc: Fix potential ep0 BD table leak

[Guangshuo Li]

The ep0 BD list is kept across disconnects, and ep0 does not have
BDC_EP_ENABLED set after allocation. Consequently bdc_free_ep() skips
its tables before the BD table pool is destroyed.

Free an allocated ep0 BD list during final endpoint teardown.

This issue was found by our static analysis tool under development.

Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
 drivers/usb/gadget/udc/bdc/bdc_ep.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index a7a22e5ec47b..db176636355d 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -908,7 +908,8 @@ void bdc_free_ep(struct bdc *bdc)
 		if (!ep)
 			continue;
 
-		if (ep->flags & BDC_EP_ENABLED)
+		if ((ep->flags & BDC_EP_ENABLED) ||
+		    (epnum == 1 && ep->bd_list.num_tabs))
 			ep_bd_list_free(ep, ep->bd_list.num_tabs);
 
 		/* ep0 is not in this gadget list */

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4