diff mbox series

[v1,2/3] f_rockusb: Avoid use-after-free in the global pointer variable

Message ID 20201203153205.22966-2-andriy.shevchenko@linux.intel.com
State Accepted
Commit ff52577c1b5188a5f25bd7d7d41730bb5de4b688
Delegated to: Lukasz Majewski
Headers show
Series [v1,1/3] f_rockusb: Use NULL instead of 0 for pointers | expand

Commit Message

Andy Shevchenko Dec. 3, 2020, 3:32 p.m. UTC
In case of usb_add_function() failure the error path has two issues:
 - the potentially allocated structure isn't getting freed
 - the global pointer variable is assigned to garbage

Fix the above mentioned issues by freeing memory and assigning NULL.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/usb/gadget/f_rockusb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/usb/gadget/f_rockusb.c b/drivers/usb/gadget/f_rockusb.c
index 9dd10f9e9aa1..bd846ce9a77b 100644
--- a/drivers/usb/gadget/f_rockusb.c
+++ b/drivers/usb/gadget/f_rockusb.c
@@ -309,8 +309,9 @@  static int rockusb_add(struct usb_configuration *c)
 
 	status = usb_add_function(c, &f_rkusb->usb_function);
 	if (status) {
+		free(f_rkusb->buf_head);
 		free(f_rkusb);
-		rockusb_func = f_rkusb;
+		rockusb_func = NULL;
 	}
 	return status;
 }