diff options
| author | Kuen-Han Tsai <khtsai@google.com> | 2026-03-20 16:54:44 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-04-11 14:24:50 +0200 |
| commit | cc8ec610cd14c093a19371691a7ce1ee5421e829 (patch) | |
| tree | 7fd59d7fe82cbe751613719b2f95bfd8aee1f8c8 /drivers/usb | |
| parent | 8a1128d604c360eca135f15b882b70256a522145 (diff) | |
| download | linux-cc8ec610cd14c093a19371691a7ce1ee5421e829.tar.gz linux-cc8ec610cd14c093a19371691a7ce1ee5421e829.tar.bz2 linux-cc8ec610cd14c093a19371691a7ce1ee5421e829.zip | |
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
commit caa27923aacd8a5869207842f2ab1657c6c0c7bc upstream.
geth_alloc() increments the reference count, but geth_free() fails to
decrement it. This prevents the configuration of attributes via configfs
after unlinking the function.
Decrement the reference count in geth_free() to ensure proper cleanup.
Fixes: 02832e56f88a ("usb: gadget: f_subset: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-1-4886b578161b@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/function/f_subset.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c index ea3fdd842462..a404c11acac6 100644 --- a/drivers/usb/gadget/function/f_subset.c +++ b/drivers/usb/gadget/function/f_subset.c @@ -6,6 +6,7 @@ * Copyright (C) 2008 Nokia Corporation */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h> @@ -449,8 +450,13 @@ static struct usb_function_instance *geth_alloc_inst(void) static void geth_free(struct usb_function *f) { struct f_gether *eth; + struct f_gether_opts *opts; + + opts = container_of(f->fi, struct f_gether_opts, func_inst); eth = func_to_geth(f); + scoped_guard(mutex, &opts->lock) + opts->refcnt--; kfree(eth); } |