This is a note to let you know that I've just added the patch titled
usb: gadget: f_hid: fix refcount leak on error path
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-gadget-f_hid-fix-refcount-leak-on-error-path.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit d8640720a46a840a67ce2b1a8bbe22b1209e3ff4
Author: John Keeping <john@xxxxxxxxxxxx>
Date: Tue Nov 22 12:35:22 2022 +0000
usb: gadget: f_hid: fix refcount leak on error path
[ Upstream commit 70a3288a7586526315105c699b687d78cd32559a ]
When failing to allocate report_desc, opts->refcnt has already been
incremented so it needs to be decremented to avoid leaving the options
structure permanently locked.
Fixes: 21a9476a7ba8 ("usb: gadget: hid: add configfs support")
Tested-by: Lee Jones <lee@xxxxxxxxxx>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@xxxxxxxxxxxxx>
Reviewed-by: Lee Jones <lee@xxxxxxxxxx>
Signed-off-by: John Keeping <john@xxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20221122123523.3068034-3-john@xxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 2aaa3ea74e5a..ea877cba0763 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1298,6 +1298,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
GFP_KERNEL);
if (!hidg->report_desc) {
put_device(&hidg->dev);
+ --opts->refcnt;
mutex_unlock(&opts->lock);
return ERR_PTR(-ENOMEM);
}
