From e5a925543b6a86bc18837f9700dfd7fd8b196529 Mon Sep 17 00:00:00 2001 From: dongjiuzhu1 Date: Fri, 12 Jan 2024 15:48:16 +0800 Subject: [PATCH] drivers/usbdev: fix double free when cdcacm uninitialize with not used Signed-off-by: dongjiuzhu1 --- drivers/usbdev/cdcacm.c | 16 ++++------------ include/nuttx/usb/cdcacm.h | 3 ++- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/drivers/usbdev/cdcacm.c b/drivers/usbdev/cdcacm.c index 3789f8e07c..4e4c9da12b 100644 --- a/drivers/usbdev/cdcacm.c +++ b/drivers/usbdev/cdcacm.c @@ -3071,6 +3071,10 @@ void cdcacm_uninitialize(FAR struct usbdevclass_driver_s *classdev) char devname[CDCACM_DEVNAME_SIZE]; int ret; +#ifndef CONFIG_CDCACM_COMPOSITE + usbdev_unregister(&drvr->drvr); +#endif + /* Un-register the CDC/ACM TTY device */ snprintf(devname, CDCACM_DEVNAME_SIZE, CDCACM_DEVNAME_FORMAT, priv->minor); @@ -3080,18 +3084,6 @@ void cdcacm_uninitialize(FAR struct usbdevclass_driver_s *classdev) usbtrace(TRACE_CLSERROR(USBSER_TRACEERR_UARTUNREGISTER), (uint16_t)-ret); } - -#ifndef CONFIG_CDCACM_COMPOSITE - usbdev_unregister(&drvr->drvr); -#endif - - /* And free the memory resources. */ - - if (priv->serdev.open_count <= 0) - { - wd_cancel(&priv->rxfailsafe); - kmm_free(priv); - } } /**************************************************************************** diff --git a/include/nuttx/usb/cdcacm.h b/include/nuttx/usb/cdcacm.h index d9ad17d108..98d7d3f8f4 100644 --- a/include/nuttx/usb/cdcacm.h +++ b/include/nuttx/usb/cdcacm.h @@ -312,6 +312,8 @@ enum cdcacm_event_e typedef CODE void (*cdcacm_callback_t)(enum cdcacm_event_e event); +struct usbdevclass_driver_s; + /**************************************************************************** * Public Function Prototypes ****************************************************************************/ @@ -336,7 +338,6 @@ typedef CODE void (*cdcacm_callback_t)(enum cdcacm_event_e event); #if defined(CONFIG_USBDEV_COMPOSITE) && defined(CONFIG_CDCACM_COMPOSITE) struct usbdev_devinfo_s; -struct usbdevclass_driver_s; int cdcacm_classobject(int minor, FAR struct usbdev_devinfo_s *devinfo, FAR struct usbdevclass_driver_s **classdev); #endif