diff options
| author | Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2017-02-21 22:33:11 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-12-16 10:32:28 +0100 |
| commit | 4c09b39cd9934b94979103398a0dbd506579cb3f (patch) | |
| tree | 794acfc15e1879aff656e917f8405534e1839ad2 | |
| parent | 3e92917312918da12d89fc86cea1c977abc92e98 (diff) | |
| download | linux-4c09b39cd9934b94979103398a0dbd506579cb3f.tar.gz linux-4c09b39cd9934b94979103398a0dbd506579cb3f.tar.bz2 linux-4c09b39cd9934b94979103398a0dbd506579cb3f.zip | |
USB: gadgetfs: Fix a potential memory leak in 'dev_config()'
[ Upstream commit b6e7aeeaf235901c42ec35de4633c7c69501d303 ]
'kbuf' is allocated just a few lines above using 'memdup_user()'.
If the 'if (dev->buf)' test fails, this memory is never released.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/gadget/legacy/inode.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index 368d07937848..e2d57e3d67c7 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1921,8 +1921,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) spin_lock_irq (&dev->lock); value = -EINVAL; - if (dev->buf) + if (dev->buf) { + kfree(kbuf); goto fail; + } dev->buf = kbuf; /* full or low speed config */ |