diff options
author | Ben Hutchings <ben@decadent.org.uk> | 2015-03-29 16:21:52 +0100 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2015-05-09 23:16:25 +0100 |
commit | 98a0e0adabd49256188d9d37d46c0118c4984b24 (patch) | |
tree | ed9dd6e0b8eb33b05d575ef6738e333bdc731cc6 /drivers | |
parent | f872bbe889c7c78edb222854217b02aaf24b4254 (diff) |
gadgetfs: Fix leak on error in aio_read()
The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.
This fix is not needed upstream as that error path was removed
by commit 7fe3976e0f3a ('gadget: switch ep_io_operations to
->read_iter/->write_iter').
Fixes: f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/usb/gadget/inode.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index d00b3e3a6cfe..ce7253bfaa95 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -648,6 +648,7 @@ fail: value = get_ready_ep(iocb->ki_filp->f_flags, epdata); if (unlikely(value < 0)) { + kfree(priv->iv); kfree(priv); goto fail; } |