Commit 2bb2077e authored Mar 13, 2015 by Dan Carpenter Committed by Felipe Balbi Mar 13, 2015

usb: gadget: printer: use after free in gprinter_alloc_inst()



There was a missing goto so we free "opts" and then dereference it.

Fixes: ee1cd515 ('usb: gadget: printer: add configfs support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

parent fdb51e3d

drivers/usb/gadget/function/f_printer.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1307,6 +1307,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void)
		kfree(opts);
		if (idr_is_empty(&printer_ida.idr))
		gprinter_cleanup();
		goto unlock;
		}
		config_group_init_type_name(&opts->func_inst.group, "",
		&printer_func_type);