[PATCH] usb: gadget: uvc: Fix config_item reference leak in uvc_alloc()

[Wentao Liang]

uvc_alloc() gets a reference on the streaming header item with
config_group_find_item(). If the header is not linked to a streaming
interface the function returns -EBUSY after freeing uvc, so
uvc_free() never runs and the reference is leaked. Drop it before
returning.

Fixes: 3180d827c807 ("usb: gadget: uvc: don't put item still in use")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/gadget/function/f_uvc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index 8d404d88391c..eb5837b17e6b 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -1126,6 +1126,7 @@ static struct usb_function *uvc_alloc(struct usb_function_instance *fi)
 
 		uvc->header = to_uvcg_streaming_header(h);
 		if (!uvc->header->linked) {
+			config_item_put(h);
 			mutex_unlock(&opts->lock);
 			kfree(uvc);
 			return ERR_PTR(-EBUSY);
-- 
2.34.1