Re: [syzbot] [usb?] memory leak in hidg_bind

From: Edward Adam Davis

Date: Sun Aug 09 2026 - 21:24:56 EST


#syz test

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 3c6b43d06a6d..0aa14b99d97e 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1163,8 +1163,10 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
/* maybe allocate device-global string IDs, and patch descriptors */
us = usb_gstrings_attach(c->cdev, ct_func_strings,
ARRAY_SIZE(ct_func_string_defs));
- if (IS_ERR(us))
- return PTR_ERR(us);
+ if (IS_ERR(us)) {
+ status = PTR_ERR(us);
+ goto fail;
+ }
hidg_interface_desc.iInterface = us[CT_FUNC_HID_IDX].id;

/* allocate instance-specific interface IDs, and patch descriptors */