Commit 2bb2077e authored by Dan Carpenter's avatar Dan Carpenter Committed by Felipe Balbi

usb: gadget: printer: use after free in gprinter_alloc_inst()

There was a missing goto so we free "opts" and then dereference it.

Fixes: ee1cd515 ('usb: gadget: printer: add configfs support')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent fdb51e3d
...@@ -1307,6 +1307,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void) ...@@ -1307,6 +1307,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void)
kfree(opts); kfree(opts);
if (idr_is_empty(&printer_ida.idr)) if (idr_is_empty(&printer_ida.idr))
gprinter_cleanup(); gprinter_cleanup();
goto unlock;
} }
config_group_init_type_name(&opts->func_inst.group, "", config_group_init_type_name(&opts->func_inst.group, "",
&printer_func_type); &printer_func_type);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment