There are two bugs: dev->buf does not need to be released if it already exists before executing dev_config. dev->config and dev->hs_config and dev->dev need to be cleaned if dev_config fails to avoid UAF. v2: 1. break one patch up into two separate patches. 2. use "fail:" to clear all members. v3: fix a mistake in [PATCH v3 2/2] v4: avoid multiple unnecessary statement labels in [PATCH v4 2/2] Hangyu Hua (2): usb: gadget: don't release an existing dev->buf usb: gadget: clear related members when goto fail drivers/usb/gadget/legacy/inode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.25.1
