Commit 828f6148 authored by Dan Carpenter's avatar Dan Carpenter Committed by Felipe Balbi

usb: gadget: f_hid: use after free in hidg_alloc_inst()

We free "opts" on the error path and then dereference it.

Fixes: 21a9476a ('usb: gadget: hid: add configfs support')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent efed421a
...@@ -875,6 +875,7 @@ static struct usb_function_instance *hidg_alloc_inst(void) ...@@ -875,6 +875,7 @@ static struct usb_function_instance *hidg_alloc_inst(void)
kfree(opts); kfree(opts);
if (idr_is_empty(&hidg_ida.idr)) if (idr_is_empty(&hidg_ida.idr))
ghid_cleanup(); ghid_cleanup();
goto unlock;
} }
config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type); config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment