| From | Ben Hutchings <> | Date | Tue, 05 May 2015 02:16:39 +0100 | Subject | [PATCH 3.2 095/221] gadgetfs: Fix leak on error in aio_read() |
| |
3.2.69-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
The previous fix, 'gadgetfs: use-after-free in ->aio_read()', missed one error path where the iovec needs to be freed.
This fix is not needed upstream as that error path was removed by commit 7fe3976e0f3a ('gadget: switch ep_io_operations to ->read_iter/->write_iter').
Fixes: f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()') Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -648,6 +648,7 @@ fail: value = get_ready_ep(iocb->ki_filp->f_flags, epdata); if (unlikely(value < 0)) { + kfree(priv->iv); kfree(priv); goto fail; }
|