From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 13 Nov 2014 06:19:47 +0000 (+0300)
Subject: usb: gadget: f_hid: use after free in hidg_alloc_inst()
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=828f6148e89ec051c2540400773655c0174ccaa3;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

usb: gadget: f_hid: use after free in hidg_alloc_inst()

We free "opts" on the error path and then dereference it.

Fixes: 21a9476a7ba8 ('usb: gadget: hid: add configfs support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
---

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 7d18f413ffea..f0545f801c9d 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -875,6 +875,7 @@ static struct usb_function_instance *hidg_alloc_inst(void)
 		kfree(opts);
 		if (idr_is_empty(&hidg_ida.idr))
 			ghid_cleanup();
+		goto unlock;
 	}
 	config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type);