diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-11-13 09:19:47 +0300 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2014-11-18 08:47:44 -0600 |
| commit | 828f6148e89ec051c2540400773655c0174ccaa3 (patch) | |
| tree | beb82dfe31dfc867320daabead8e6fd5f8247f80 /drivers/usb/gadget/function/f_hid.c | |
| parent | efed421a94e62a7ddbc76acba4312b70e4be958f (diff) | |
| download | op-kernel-dev-828f6148e89ec051c2540400773655c0174ccaa3.zip op-kernel-dev-828f6148e89ec051c2540400773655c0174ccaa3.tar.gz | |
usb: gadget: f_hid: use after free in hidg_alloc_inst()
We free "opts" on the error path and then dereference it.
Fixes: 21a9476a7ba8 ('usb: gadget: hid: add configfs support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb/gadget/function/f_hid.c')
| -rw-r--r-- | drivers/usb/gadget/function/f_hid.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 7d18f41..f0545f8 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -875,6 +875,7 @@ static struct usb_function_instance *hidg_alloc_inst(void) kfree(opts); if (idr_is_empty(&hidg_ida.idr)) ghid_cleanup(); + goto unlock; } config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type); |
