[PATCH] usb: gadget: f_hid: fix device reference leak in hidg_alloc()

[PATCH] usb: gadget: f_hid: fix device reference leak in hidg_alloc()

[Guangshuo Li]

hidg_alloc() initializes hidg->dev with device_initialize() before
calling dev_set_name(). If dev_set_name() fails, the function currently
jumps to err_unlock and returns without calling put_device().

This leaves the device reference unbalanced and prevents hidg_release()
from being called. Calling put_device() here is also safe, since
hidg_release() only frees resources owned by hidg.

Route the dev_set_name() failure path through err_put_device so the
device reference is dropped properly.

Fixes: 944fe915d00d ("usb: gadget: f_hid: tidy error handling in hidg_alloc")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/usb/gadget/function/f_hid.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 3ddfd4f66f0b..2734ebd35bda 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -1610,7 +1610,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
 	hidg->dev.devt = MKDEV(major, opts->minor);
 	ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor);
 	if (ret)
-		goto err_unlock;
+		goto err_put_device;
 
 	hidg->bInterfaceSubClass = opts->subclass;
 	hidg->bInterfaceProtocol = opts->protocol;
@@ -1647,7 +1647,6 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
 
 err_put_device:
 	put_device(&hidg->dev);
-err_unlock:
 	mutex_unlock(&opts->lock);
 	return ERR_PTR(ret);
 }
-- 
2.43.0

Re: [PATCH] usb: gadget: f_hid: fix device reference leak in hidg_alloc()

[Johan Hovold]

On Mon, Apr 13, 2026 at 12:15:55AM +0800, Guangshuo Li wrote:
> hidg_alloc() initializes hidg->dev with device_initialize() before
> calling dev_set_name(). If dev_set_name() fails, the function currently
> jumps to err_unlock and returns without calling put_device().
> 
> This leaves the device reference unbalanced and prevents hidg_release()
> from being called. Calling put_device() here is also safe, since
> hidg_release() only frees resources owned by hidg.

Good catch.

> Route the dev_set_name() failure path through err_put_device so the
> device reference is dropped properly.
> 
> Fixes: 944fe915d00d ("usb: gadget: f_hid: tidy error handling in hidg_alloc")

This isn't the commit that introduced the issue, though. This should be:

Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev")

With that fixed you can add my:

Reviewed-by: Johan Hovold <johan@kernel.org>

Johan

Re: [PATCH] usb: gadget: f_hid: fix device reference leak in hidg_alloc()

[Guangshuo Li]

Hi Johan,

Thanks for the review and for pointing that out.

You're right, the correct Fixes tag should be:

Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev")

I'll send a v2 shortly with that fixed and include your Reviewed-by tag.

Reviewed-by: Johan Hovold johan@kernel.org

Thanks,
Guangshuo

Johan Hovold <johan@kernel.org> 于2026年4月13日周一 15:40写道：
>
> On Mon, Apr 13, 2026 at 12:15:55AM +0800, Guangshuo Li wrote:
> > hidg_alloc() initializes hidg->dev with device_initialize() before
> > calling dev_set_name(). If dev_set_name() fails, the function currently
> > jumps to err_unlock and returns without calling put_device().
> >
> > This leaves the device reference unbalanced and prevents hidg_release()
> > from being called. Calling put_device() here is also safe, since
> > hidg_release() only frees resources owned by hidg.
>
> Good catch.
>
> > Route the dev_set_name() failure path through err_put_device so the
> > device reference is dropped properly.
> >
> > Fixes: 944fe915d00d ("usb: gadget: f_hid: tidy error handling in hidg_alloc")
>
> This isn't the commit that introduced the issue, though. This should be:
>
> Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev")
>
> With that fixed you can add my:
>
> Reviewed-by: Johan Hovold <johan@kernel.org>
>
> Johan