]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
authorGuangshuo Li <lgs201920130244@gmail.com>
Mon, 13 Apr 2026 14:21:19 +0000 (22:21 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 22 May 2026 08:34:06 +0000 (10:34 +0200)
commit4f88d65def6f3c90121601b4f62a4c967f3063a6
treeca17f69e7afc446f8003728bf33b12f96fd6916f
parente194ce048f5a6c549b3a23a8c568c6470f40f772
usb: gadget: f_hid: fix device reference leak in hidg_alloc()

hidg_alloc() initializes hidg->dev with device_initialize() before
calling dev_set_name(). If dev_set_name() fails, the function currently
jumps to err_unlock and returns without calling put_device().

This leaves the device reference unbalanced and prevents hidg_release()
from being called. Calling put_device() here is also safe, since
hidg_release() only frees resources owned by hidg.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Route the dev_set_name() failure path through err_put_device so the
device reference is dropped properly.

Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev")
Cc: stable <stable@kernel.org>
Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Johan Hovold johan@kernel.org
Link: https://patch.msgid.link/20260413142119.2977716-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/f_hid.c