diff options
| author | Alan Stern <[email protected]> | 2018-01-03 17:51:51 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2018-01-09 15:06:53 +0000 |
| commit | 7ae2c3c280db183ca9ada2675c34ec2f7378abfa (patch) | |
| tree | 67af2f403b945235aa311ec41abfe1b2c89a7085 /scripts/gcc-plugins/sancov_plugin.c | |
| parent | USB: fix usbmon BUG trigger (diff) | |
| download | kernel-7ae2c3c280db183ca9ada2675c34ec2f7378abfa.tar.gz kernel-7ae2c3c280db183ca9ada2675c34ec2f7378abfa.zip | |
USB: UDC core: fix double-free in usb_add_gadget_udc_release
The error-handling pathways in usb_add_gadget_udc_release() are messed
up. Aside from the uninformative statement labels, they can deallocate
the udc structure after calling put_device(), which is a double-free.
This was observed by KASAN in automatic testing.
This patch cleans up the routine. It preserves the requirement that
when any failure occurs, we call put_device(&gadget->dev).
Signed-off-by: Alan Stern <[email protected]>
Reported-by: Fengguang Wu <[email protected]>
CC: <[email protected]>
Reviewed-by: Peter Chen <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'scripts/gcc-plugins/sancov_plugin.c')
0 files changed, 0 insertions, 0 deletions