diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2015-03-29 16:21:52 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-05-09 23:16:25 +0100 |
| commit | 98a0e0adabd49256188d9d37d46c0118c4984b24 (patch) | |
| tree | ed9dd6e0b8eb33b05d575ef6738e333bdc731cc6 /drivers/usb | |
| parent | f872bbe889c7c78edb222854217b02aaf24b4254 (diff) | |
| download | kernel_samsung_smdk4412-98a0e0adabd49256188d9d37d46c0118c4984b24.zip kernel_samsung_smdk4412-98a0e0adabd49256188d9d37d46c0118c4984b24.tar.gz kernel_samsung_smdk4412-98a0e0adabd49256188d9d37d46c0118c4984b24.tar.bz2 | |
gadgetfs: Fix leak on error in aio_read()
The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.
This fix is not needed upstream as that error path was removed
by commit 7fe3976e0f3a ('gadget: switch ep_io_operations to
->read_iter/->write_iter').
Fixes: f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/inode.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index d00b3e3..ce7253b 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -648,6 +648,7 @@ fail: value = get_ready_ep(iocb->ki_filp->f_flags, epdata); if (unlikely(value < 0)) { + kfree(priv->iv); kfree(priv); goto fail; } |