From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934536AbdK2R1P (ORCPT ); Wed, 29 Nov 2017 12:27:15 -0500 Received: from fldsmtpe03.verizon.com ([140.108.26.142]:24530 "EHLO fldsmtpe03.verizon.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934416AbdK2RX5 (ORCPT ); Wed, 29 Nov 2017 12:23:57 -0500 From: alexander.levin@verizon.com Cc: Christophe JAILLET , Felipe Balbi , alexander.levin@verizon.com X-Host: endeavour.tdc.vzwcorp.com To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [PATCH AUTOSEL for 3.18 03/16] USB: gadgetfs: Fix a potential memory leak in 'dev_config()' Thread-Topic: [PATCH AUTOSEL for 3.18 03/16] USB: gadgetfs: Fix a potential memory leak in 'dev_config()' Thread-Index: AQHTaTacEsaGVfPq80azdg9jLpFgtA== Date: Wed, 29 Nov 2017 17:22:19 +0000 Message-ID: <20171129172213.29007-3-alexander.levin@verizon.com> References: <20171129172213.29007-1-alexander.levin@verizon.com> In-Reply-To: <20171129172213.29007-1-alexander.levin@verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id vATHRL50032616 From: Christophe JAILLET [ Upstream commit b6e7aeeaf235901c42ec35de4633c7c69501d303 ] 'kbuf' is allocated just a few lines above using 'memdup_user()'. If the 'if (dev->buf)' test fails, this memory is never released. Signed-off-by: Christophe JAILLET Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/gadget/legacy/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index 368d07937848..e2d57e3d67c7 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1921,8 +1921,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) spin_lock_irq (&dev->lock); value = -EINVAL; - if (dev->buf) + if (dev->buf) { + kfree(kbuf); goto fail; + } dev->buf = kbuf; /* full or low speed config */ -- 2.11.0