USB: UDC core: fix double-free in usb_add_gadget_udc_release
authorAlan Stern <stern@rowland.harvard.edu>
Wed, 3 Jan 2018 17:51:51 +0000 (12:51 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 9 Jan 2018 15:06:53 +0000 (16:06 +0100)
commit7ae2c3c280db183ca9ada2675c34ec2f7378abfa
tree67af2f403b945235aa311ec41abfe1b2c89a7085
parent46eb14a6e1585d99c1b9f58d0e7389082a5f466b
USB: UDC core: fix double-free in usb_add_gadget_udc_release

The error-handling pathways in usb_add_gadget_udc_release() are messed
up.  Aside from the uninformative statement labels, they can deallocate
the udc structure after calling put_device(), which is a double-free.
This was observed by KASAN in automatic testing.

This patch cleans up the routine.  It preserves the requirement that
when any failure occurs, we call put_device(&gadget->dev).

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
CC: <stable@vger.kernel.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/udc/core.c