From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A94A047B429; Tue, 16 Jun 2026 17:59:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781632765; cv=none; b=TO2oiHB2P/RVBvYrzbG2MxUDSc6HD5sMzXJAai2d6dBLdo7mV7r43TG0tdRRBquZjxXqHEFv1jJdZRagyO+q2m3RVQ1pj7xJ1EoeGY78OBjVG3FTJ2Jm4l+4wwfr4ExjmB8M1gC13DvJstDPw4gjmt6Ymmitek9yFG0P9xu+jBQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781632765; c=relaxed/simple; bh=Zlw8rRB8j7L7q3Hwh4HFevaoa2OKsGrqbusXXk0dqm0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KzxyF+UODPF7ByStBnxkRC59DQKblmY76o57/NjyeDUNq5C0xUdiEeSP6lNzN6+/nXSMmpzachjfKeN57+EM6HaEZdoQtUXx3ir24xdw3aR5T5bIAscU+o9tkKWUHCbF/gCbfioasSzIvhnVOK7LyJ/QGtfG13ncxnBoI5t8Ew4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uTW10WhY; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uTW10WhY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 748121F000E9; Tue, 16 Jun 2026 17:59:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781632764; bh=XfNOqafDacKGXlniQR4WBwwdMP//h+t3dCBjCgIdWIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=uTW10WhYpagLfl5LuJZZOimHdwoToNZLWqSTd9KFqEkRsafymny5AduH17ExRIf9o kVo41xCtPeiZJF57Sw9sR3V4ABgwIY19K7fBiz5TqP8lKw7J5rqEXhgMnw27cTe0QM RxB80G4n+IUmwrWW/afQ0aW46MNpuvQRYQPRrkls= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Lee Jones , Andrzej Pietrasiewicz , John Keeping , Sasha Levin Subject: [PATCH 6.1 471/522] usb: gadget: f_hid: tidy error handling in hidg_alloc Date: Tue, 16 Jun 2026 20:30:18 +0530 Message-ID: <20260616145147.887431764@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145125.307082728@linuxfoundation.org> References: <20260616145125.307082728@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: John Keeping [ Upstream commit 944fe915d00d3cb1bacb1e77cabfb6dc82e6f8b8 ] Unify error handling at the end of the function, reducing the risk of missing something on one of the error paths. Moving the increment of opts->refcnt later means there is no need to decrement it on the error path and is safe as this is guarded by opts->lock which is held for this entire section. Tested-by: Lee Jones Reviewed-by: Andrzej Pietrasiewicz Reviewed-by: Lee Jones Signed-off-by: John Keeping Link: https://lore.kernel.org/r/20221122123523.3068034-4-john@metanate.com Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 4f88d65def6f ("usb: gadget: f_hid: fix device reference leak in hidg_alloc()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_hid.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1265,7 +1265,6 @@ static struct usb_function *hidg_alloc(s opts = container_of(fi, struct f_hid_opts, func_inst); mutex_lock(&opts->lock); - ++opts->refcnt; spin_lock_init(&hidg->write_spinlock); spin_lock_init(&hidg->read_spinlock); @@ -1278,11 +1277,8 @@ static struct usb_function *hidg_alloc(s hidg->dev.class = hidg_class; hidg->dev.devt = MKDEV(major, opts->minor); ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor); - if (ret) { - --opts->refcnt; - mutex_unlock(&opts->lock); - return ERR_PTR(ret); - } + if (ret) + goto err_unlock; hidg->bInterfaceSubClass = opts->subclass; hidg->bInterfaceProtocol = opts->protocol; @@ -1293,14 +1289,13 @@ static struct usb_function *hidg_alloc(s opts->report_desc_length, GFP_KERNEL); if (!hidg->report_desc) { - put_device(&hidg->dev); - --opts->refcnt; - mutex_unlock(&opts->lock); - return ERR_PTR(-ENOMEM); + ret = -ENOMEM; + goto err_put_device; } } hidg->use_out_ep = !opts->no_out_endpoint; + ++opts->refcnt; mutex_unlock(&opts->lock); hidg->func.name = "hid"; @@ -1315,6 +1310,12 @@ static struct usb_function *hidg_alloc(s hidg->qlen = 4; return &hidg->func; + +err_put_device: + put_device(&hidg->dev); +err_unlock: + mutex_unlock(&opts->lock); + return ERR_PTR(ret); } DECLARE_USB_FUNCTION_INIT(hid, hidg_alloc_inst, hidg_alloc);