From nobody Sat Jun 20 17:34:34 2026 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 036A32765C4 for ; Sun, 12 Apr 2026 16:16:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776010575; cv=none; b=iZPMRA4NHpw5d5NSj4+Eo5zS4SaqWK+i6vt/GnUMSUvK7n9Scf4WPhfPW9JlmdzivgajoMJG7uSPQ4IJa/uO6K75zzq2sj0GIkZJCJqwNeYD/Fs4RPpverd0Wmdxmeiz+a2T20Xj3pceNDpdiAYAdcR/qumb+CPQ0wF8BOqHBqA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776010575; c=relaxed/simple; bh=6IlgXTFSmFVd7hT6b2wcB0Awnk4YrKROVYLwrLdRd0w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eCOd3yxWklLzCd0tkyiHhQ4MumGFpXvOgjCvBf2yqzROP4SSGIwSeQg6hsJSonwYcRYHQes7nJkduYGUFGhO9RqCoylh/ZZVyD8nBTcR+uJAXNvyVyobR/15tIr3IeHmBpx0fs6gXuO/5eYft4dgey9wMV8U4vnIg4yklG54oWw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=h5oMlGnN; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="h5oMlGnN" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-35e5770d013so508213a91.0 for ; Sun, 12 Apr 2026 09:16:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776010572; x=1776615372; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=iBpA6cw876MX1y6VPWdZbugAryZAfoX9nVBjKfMU+gc=; b=h5oMlGnNKlq/XPXcTJMDh7SS6vKhBIk6zZAm2kIwZr4vQwLHyp1bbT7cuFPVzNS9NU l9bX2UxulWqsvv/VBkzVRVbbB1yWyRxs2do6uD57je8VumCD67RBTy84GceKTi9UHdLj fvbJNHS4yj4bqg3FN2ltgv1fxPermhpGsiH9uwEfMv/kz+XREcmh4ykRU/+dYIGImFLN vwjwpP4s3sJ3E4DzMkSeUr/7xUPcTTXG2AH4IGOK2K85lZFkT8pV6/oMcyvtvPduoPtu E9e2wVK6dgefbS+m+Dmm6ppNn47e/ySdI3lCqtNzIY2BzottROug+eY/T7ZbZcqhjW1N +Pmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776010572; x=1776615372; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=iBpA6cw876MX1y6VPWdZbugAryZAfoX9nVBjKfMU+gc=; b=bOOcJqSpK0Z2ZF5Nct2IbcEnzQul3FzHyxm8owcWUv9z17S4n+vXMVWb1IhxnPeqIB nCl4J/FwE5BHw+lq1Co8eRybj6/56iWcn8ulW0wUaiAwrNlLzCMadXiUkdh6xGWweSNq T/1cjiCPMrb0jZ1WMoQTljHTDrBCgrlL97yeYD0+yyTX0nxlpT/+B2WL+HUnfRmp/+Rj 8Gf3gTJthcMjEkFe0lJ7v3kEaRbxtGEmucUsOEPKsOSnLt+mEahg7w8uXckQVDpRHRXN JxrxSTKtF+szt4buV8s3VJTmvtW1dQS9xWScduiq/mh6b3U1SLNVZx26cbunKpphGMlL xZzg== X-Forwarded-Encrypted: i=1; AFNElJ9unJJK+8OMUSkCJY7t01PgZgkjoBoo09gKbzfnwg/0uHiS2jdehdIZV8Oyu9Puc9ETCSM9vmFRkX32olY=@vger.kernel.org X-Gm-Message-State: AOJu0YxC+y2Lq3sJuJenKpNptOapEUYAG5H2BJMiIgh5UvpS5AJlafeY fpdPW6VdLDN7WvY85N47s3ocvS4NnLIIxTHDtFJRaIjgeJINXRcsSBh3cqG/zJH1ftkL7Q== X-Gm-Gg: AeBDietr+JXReTSBY5AT6Bwob9aposS6CY9ZJqCaHlTxxaaC3BVwsuyRTtj1HXr1pez IWd1oPUalzfYrGE3dfkGmX6v5m9j4Swvan40DEDPox5f2r/s/N6I0tljm8wbEOFvzNkV/aeOLgp kE+qOfD6mRx+y0jsJyXVHCpe+ojCo+4Vhgs54Kpxgv9Fg4GYteMTlAE92O3fnrKg59L/IAwM/+v 0gdvBhsKPbJfxY/fYeCc6YEPhY9Dyfl7dv9RLI+zhOdNWIUmO9pbsYmAQIYHRYAN6AlrF3lNvS0 /PXMjSV2KE3BUTjVWKKtEXPP+RWHV9EjGan0FpA5JTwTzLeXabIvdPjUwRuQ40OWP831Ck1hxq4 Y/kcy4jI6wjfB+DJafHtyu/jajNQigfAngdO3ulo5FD4gHwNAaL4KkAvnqZU79L5p71T9ySBoTS tiXcGAMvPiopymAnC2NqRr5WDrKqF7PdfPFg== X-Received: by 2002:a17:902:8211:b0:2b2:d126:4e77 with SMTP id d9443c01a7336-2b2d5975bdfmr73934235ad.11.1776010572329; Sun, 12 Apr 2026 09:16:12 -0700 (PDT) Received: from lgs.. ([2409:893d:1188:142d:f515:539:1a62:ab91]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2d4daede9sm117501075ad.14.2026.04.12.09.16.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Apr 2026 09:16:11 -0700 (PDT) From: Guangshuo Li To: Greg Kroah-Hartman , Marco Crivellari , Ben Hoff , Guangshuo Li , Yuhao Jiang , William Wu , Terry Junge , Andrzej Pietrasiewicz , John Keeping , Lee Jones , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: [PATCH] usb: gadget: f_hid: fix device reference leak in hidg_alloc() Date: Mon, 13 Apr 2026 00:15:55 +0800 Message-ID: <20260412161555.2568840-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hidg_alloc() initializes hidg->dev with device_initialize() before calling dev_set_name(). If dev_set_name() fails, the function currently jumps to err_unlock and returns without calling put_device(). This leaves the device reference unbalanced and prevents hidg_release() from being called. Calling put_device() here is also safe, since hidg_release() only frees resources owned by hidg. Route the dev_set_name() failure path through err_put_device so the device reference is dropped properly. Fixes: 944fe915d00d ("usb: gadget: f_hid: tidy error handling in hidg_alloc= ") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Johan Hovold Reviewed-by: Johan Hovold johan@kernel.org --- drivers/usb/gadget/function/f_hid.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/funct= ion/f_hid.c index 3ddfd4f66f0b..2734ebd35bda 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1610,7 +1610,7 @@ static struct usb_function *hidg_alloc(struct usb_fun= ction_instance *fi) hidg->dev.devt =3D MKDEV(major, opts->minor); ret =3D dev_set_name(&hidg->dev, "hidg%d", opts->minor); if (ret) - goto err_unlock; + goto err_put_device; =20 hidg->bInterfaceSubClass =3D opts->subclass; hidg->bInterfaceProtocol =3D opts->protocol; @@ -1647,7 +1647,6 @@ static struct usb_function *hidg_alloc(struct usb_fun= ction_instance *fi) =20 err_put_device: put_device(&hidg->dev); -err_unlock: mutex_unlock(&opts->lock); return ERR_PTR(ret); } --=20 2.43.0