From 828f6148e89ec051c2540400773655c0174ccaa3 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 13 Nov 2014 09:19:47 +0300 Subject: [PATCH] usb: gadget: f_hid: use after free in hidg_alloc_inst() We free "opts" on the error path and then dereference it. Fixes: 21a9476a7ba8 ('usb: gadget: hid: add configfs support') Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi --- drivers/usb/gadget/function/f_hid.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 7d18f413ffea..f0545f801c9d 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -875,6 +875,7 @@ static struct usb_function_instance *hidg_alloc_inst(void) kfree(opts); if (idr_is_empty(&hidg_ida.idr)) ghid_cleanup(); + goto unlock; } config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type); -- 2.11.0