[PATCH 1/2] usb: gadget: f_hid: fix memory leak on gstrings attach failure

[hanzhijian]

hidg_bind() allocates get_req with usb_ep_alloc_request() before
attaching the gadget strings.  If usb_gstrings_attach() fails, the
function returns without releasing get_req, leaking the request.

Go through the fail path in that case so get_req is released.

Reported-by: syzbot+60740c6a17a5b5eb1f5a@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?extid=60740c6a17a5b5eb1f5a
Signed-off-by: hanzhijian <hanzhijian1991@xxxxxxxxx>
---
 drivers/usb/gadget/function/f_hid.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 3c6b43d06..0aa14b99d 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1163,8 +1163,10 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
 	/* maybe allocate device-global string IDs, and patch descriptors */
 	us = usb_gstrings_attach(c->cdev, ct_func_strings,
 				 ARRAY_SIZE(ct_func_string_defs));
-	if (IS_ERR(us))
-		return PTR_ERR(us);
+	if (IS_ERR(us)) {
+		status = PTR_ERR(us);
+		goto fail;
+	}
 	hidg_interface_desc.iInterface = us[CT_FUNC_HID_IDX].id;
 
 	/* allocate instance-specific interface IDs, and patch descriptors */
-- 
2.43.0