Commit 828f6148 authored Nov 13, 2014 by Dan Carpenter Committed by Felipe Balbi Nov 18, 2014

usb: gadget: f_hid: use after free in hidg_alloc_inst()



We free "opts" on the error path and then dereference it.

Fixes: 21a9476a ('usb: gadget: hid: add configfs support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

parent efed421a

drivers/usb/gadget/function/f_hid.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -875,6 +875,7 @@ static struct usb_function_instance *hidg_alloc_inst(void)
		kfree(opts);
		if (idr_is_empty(&hidg_ida.idr))
		ghid_cleanup();
		goto unlock;
		}
		config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type);