[PATCH 3.2 095/221] gadgetfs: Fix leak on error in aio_read()

[Ben Hutchings]

3.2.69-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@xxxxxxxxxxxxxxx>

The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.

This fix is not needed upstream as that error path was removed
by commit 7fe3976e0f3a ('gadget: switch ep_io_operations to
->read_iter/->write_iter').

Fixes: f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
---
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -648,6 +648,7 @@ fail:
 
 	value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
 	if (unlikely(value < 0)) {
+		kfree(priv->iv);
 		kfree(priv);
 		goto fail;
 	}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/