This is a note to let you know that I've just added the patch titled usb: gadget: f_hid: fix refcount leak on error path to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usb-gadget-f_hid-fix-refcount-leak-on-error-path.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit cde64d068d79e02e7a592a1f13b844e696717812 Author: John Keeping <john@xxxxxxxxxxxx> Date: Tue Nov 22 12:35:22 2022 +0000 usb: gadget: f_hid: fix refcount leak on error path [ Upstream commit 70a3288a7586526315105c699b687d78cd32559a ] When failing to allocate report_desc, opts->refcnt has already been incremented so it needs to be decremented to avoid leaving the options structure permanently locked. Fixes: 21a9476a7ba8 ("usb: gadget: hid: add configfs support") Tested-by: Lee Jones <lee@xxxxxxxxxx> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@xxxxxxxxxxxxx> Reviewed-by: Lee Jones <lee@xxxxxxxxxx> Signed-off-by: John Keeping <john@xxxxxxxxxxxx> Link: https://lore.kernel.org/r/20221122123523.3068034-3-john@xxxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 97e927eacc62..e7cf56b13c64 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1292,6 +1292,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) GFP_KERNEL); if (!hidg->report_desc) { put_device(&hidg->dev); + --opts->refcnt; mutex_unlock(&opts->lock); return ERR_PTR(-ENOMEM); }