diff mbox series

[4.9,37/42] usb: gadget: Fix memleak in gadgetfs_fill_super

Message ID	20201201084645.477134828@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Hulk Robot <hulkci@huawei.com>, Alan Stern <stern@rowland.harvard.edu>, Zhang Qilong <zhangqilong3@huawei.com> Subject: [PATCH 4.9 37/42] usb: gadget: Fix memleak in gadgetfs_fill_super Date: Tue, 1 Dec 2020 09:53:35 +0100 Message-Id: <20201201084645.477134828@linuxfoundation.org> In-Reply-To: <20201201084642.194933793@linuxfoundation.org> References: <20201201084642.194933793@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,02/42] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() [4.9,03/42] btrfs: fix lockdep splat when reading qgroup config on mount [4.9,04/42] PCI: Add device even if driver attach failed [4.9,05/42] btrfs: tree-checker: Enhance chunk checker to validate chunk profile [4.9,06/42] btrfs: inode: Verify inode mode to avoid NULL pointer dereference [4.9,07/42] KVM: x86: Fix split-irqchip vs interrupt injection window request [4.9,08/42] arm64: pgtable: Fix pte_accessible() [4.9,09/42] ALSA: hda/hdmi: Use single mutex unlock in error paths [4.9,10/42] ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close [4.9,11/42] HID: cypress: Support Varmilo Keyboards media hotkeys [4.9,12/42] Input: i8042 - allow insmod to succeed on devices without an i8042 controller [4.9,13/42] HID: hid-sensor-hub: Fix issue with devices with no report ID [4.9,14/42] dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant [4.9,15/42] x86/xen: dont unbind uninitialized lock_kicker_irq [4.9,16/42] proc: dont allow async path resolution of /proc/self components [4.9,17/42] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size [4.9,18/42] scsi: libiscsi: Fix NOP race condition [4.9,19/42] scsi: target: iscsi: Fix cmd abort fabric stop race [4.9,20/42] perf/x86: fix sysfs type mismatches [4.9,21/42] phy: tegra: xusb: Fix dangling pointer on probe failure [4.9,22/42] batman-adv: set .owner to THIS_MODULE [4.9,23/42] scsi: ufs: Fix race between shutdown and runtime resume flow [4.9,24/42] bnxt_en: fix error return code in bnxt_init_board() [4.9,25/42] video: hyperv_fb: Fix the cache type when mapping the VRAM [4.9,26/42] bnxt_en: Release PCI regions when DMA mask setup fails during probe. [4.9,27/42] IB/mthca: fix return value of error branch in mthca_init_cq() [4.9,28/42] nfc: s3fwrn5: use signed integer for parsing GPIO numbers [4.9,29/42] net: ena: set initial DMA width to avoid intel iommu issue [4.9,30/42] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq [4.9,31/42] efivarfs: revert "fix memory leak in efivarfs_create()" [4.9,32/42] can: gs_usb: fix endianess problem with candleLight firmware [4.9,33/42] platform/x86: toshiba_acpi: Fix the wrong variable assignment [4.9,34/42] perf probe: Fix to die_entrypc() returns error correctly [4.9,35/42] USB: core: Change %pK for __user pointers to %px [4.9,36/42] usb: gadget: f_midi: Fix memleak in f_midi_alloc [4.9,37/42] usb: gadget: Fix memleak in gadgetfs_fill_super [4.9,38/42] x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb [4.9,39/42] regulator: avoid resolve_supply() infinite recursion [4.9,40/42] regulator: workaround self-referent regulators [4.9,41/42] USB: core: add endpoint-blacklist quirk [4.9,42/42] USB: core: Fix regression in Hercules audio card

Commit Message

Greg KH Dec. 1, 2020, 8:53 a.m. UTC

From: Zhang Qilong <zhangqilong3@huawei.com>

commit 87bed3d7d26c974948a3d6e7176f304b2d41272b upstream.

usb_get_gadget_udc_name will alloc memory for CHIP
in "Enomem" branch. we should free it before error
returns to prevent memleak.

Fixes: 175f712119c57 ("usb: gadget: provide interface for legacy gadgets to get UDC name")
Reported-by: Hulk Robot <hulkci@huawei.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201117021629.1470544-3-zhangqilong3@huawei.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/legacy/inode.c |    3 +++
 1 file changed, 3 insertions(+)

diff mbox series

Patch

--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -2045,6 +2045,9 @@  gadgetfs_fill_super (struct super_block
 	return 0;
 
 Enomem:
+	kfree(CHIP);
+	CHIP = NULL;
+
 	return -ENOMEM;
 }