3.2.69-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.
This fix is not needed upstream as that error path was removed
by commit 7fe3976e0f3a ('gadget: switch ep_io_operations to
->read_iter/->write_iter').
Fixes: f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
---
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -648,6 +648,7 @@ fail:
value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
if (unlikely(value < 0)) {
+ kfree(priv->iv);
kfree(priv);
goto fail;
}
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html