diff options
| author | Mario Schuknecht <mario.schuknecht@dresearch-fe.de> | 2014-12-16 08:58:57 +0100 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2014-12-22 10:37:15 -0600 |
| commit | b44be2462dbe3e23f0aedff64de52a1e8e47a1cd (patch) | |
| tree | 54f07a47cc3430f7c03f3145f47d7db7d9d789b7 /drivers | |
| parent | 68693b8ea4e284c46bff919ac62bd9ccdfdbb6ba (diff) | |
usb: gadget: gadgetfs: Free memory allocated by memdup_user()
Commit 3b74c73f8d6f053f422e85fce955b61fb181cfe7 switched over to memdup_user()
in ep_write() function and removed kfree (kbuf).
memdup_user() function allocates memory which is never freed.
Fixes: 3b74c73 (usb: gadget: inode: switch over to memdup_user())
Cc: <stable@vger.kernel.org> # v3.15+
Signed-off-by: Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/gadget/legacy/inode.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index c744e4975d7..08048613eed 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -449,6 +449,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) data->name, len, (int) value); free1: mutex_unlock(&data->lock); + kfree (kbuf); return value; } |