diff options
| author | Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2017-02-22 00:33:11 +0300 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2017-03-06 17:54:45 +0300 |
| commit | b6e7aeeaf235901c42ec35de4633c7c69501d303 (patch) | |
| tree | e5c1930d7726d79e10759d3c52351e168a161609 /drivers/usb | |
| parent | 4242820277b5378c9e4064e79306f326d731472f (diff) | |
| download | linux-b6e7aeeaf235901c42ec35de4633c7c69501d303.tar.xz | |
USB: gadgetfs: Fix a potential memory leak in 'dev_config()'
'kbuf' is allocated just a few lines above using 'memdup_user()'.
If the 'if (dev->buf)' test fails, this memory is never released.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/legacy/inode.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index a2615d64d07c..0513dfa008e6 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1782,8 +1782,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) spin_lock_irq (&dev->lock); value = -EINVAL; - if (dev->buf) + if (dev->buf) { + kfree(kbuf); goto fail; + } dev->buf = kbuf; /* full or low speed config */ |