usb: gadget: printer: use after free in gprinter_alloc_inst()

PATCH New Dan Carpenter 1 participant 1 message Mar 13, 2015

Subsystems (2)

USB Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2015-03-13 09:11 UTC #0 lore raw

PATCH 2/2 usb: gadget: printer: use after free in gprinter_alloc_inst()

There was a missing goto so we free "opts" and then dereference it.

Fixes ee1cd515e889 ('usb: gadget: printer: add configfs support')

Signed-off-by Dan Carpenter <[email protected]>

drivers/usb/gadget/function/f_printer.c +1 -0

index caa56de..48882ec 100644
@@ -1307,6 +1307,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void)
 		kfree(opts);
 		if (idr_is_empty(&printer_ida.idr))
 			gprinter_cleanup();
+		goto unlock;
 	}
 	config_group_init_type_name(&opts->func_inst.group, "",
 				    &printer_func_type);