Re: [syzbot] [usb?] memory leak in hidg_bind

[Edward Adam Davis]

#syz test

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 183a25f65ac8..ee7e250f8fd5 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -511,7 +511,6 @@ static void config_usb_cfg_unlink(
 		}
 	}
 	mutex_unlock(&gi->lock);
-	WARN(1, "Unable to locate function to unbind\n");
 }
 
 static const struct configfs_item_operations gadget_config_item_ops = {
@@ -1593,12 +1592,7 @@ static void purge_configs_funcs(struct gadget_info *gi)
 		list_for_each_entry_safe_reverse(f, tmp, &c->functions, list) {
 
 			list_move(&f->list, &cfg->func_list);
-			if (f->unbind) {
-				dev_dbg(&gi->cdev.gadget->dev,
-					"unbind function '%s'/%p\n",
-					f->name, f);
-				f->unbind(c, f);
-			}
+			usb_remove_function(c, f);
 		}
 		c->next_interface_id = 0;
 		memset(c->interface, 0, sizeof(c->interface));
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 3c6b43d06a6d..0799220aeb13 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1158,13 +1158,15 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
 	hidg->get_req->zero = 0;
 	hidg->get_req->complete = hidg_get_report_complete;
 	hidg->get_req->context = hidg;
-	hidg->get_report_returned = true;
+	hidg->get_report_returned = false;
 
 	/* maybe allocate device-global string IDs, and patch descriptors */
 	us = usb_gstrings_attach(c->cdev, ct_func_strings,
 				 ARRAY_SIZE(ct_func_string_defs));
-	if (IS_ERR(us))
-		return PTR_ERR(us);
+	if (IS_ERR(us)) {
+		status = PTR_ERR(us);
+		goto fail;
+	}
 	hidg_interface_desc.iInterface = us[CT_FUNC_HID_IDX].id;
 
 	/* allocate instance-specific interface IDs, and patch descriptors */