From nobody Mon Jun 15 19:03:38 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 534C13A543B for ; Mon, 13 Apr 2026 08:12:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776067971; cv=none; b=k/GNEiiu+6Cjgi8/vvCIMd8NYfbV7qYb+cTDR3gvYEpZn5X5L+E/ebrAjjuCFdv8vkjrCruoHC/kqZUgiA9V8AT7xk7DMggvxN3DRT+pRuFTG6Y1OZzxqggSc8C74+NezUlxhA1uJ6+8Z3f8+05GbHzcBCdgjRorxN6CPgxUKS8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776067971; c=relaxed/simple; bh=sNBz93ijFoNpeBDvZd30Inim2xYdS40WT3Qk1L5xZ0I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=duRU0lPFhAEhlPMzCqZnknYTa2v7aeOIfTQKjZtQQqv+aQfNhl7XPQejPlIofPGDLutwWs9tmzKrv6QIlmO0I/NgnYPb9wLcbHdpI44IP5phGxbodgC9+5P6kcqIRHbnSP9CPTq7b+czW4Q3M1osU/rT0SDaMdT/m+xkbZtwA4Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EistVyB8; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EistVyB8" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-82748257f5fso2263212b3a.1 for ; Mon, 13 Apr 2026 01:12:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776067970; x=1776672770; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=nyoodP8vqkF/vXwMMM18I+0DFbSTH1wXaH4sVIn9OTo=; b=EistVyB8V9Nj5khpByM809Gdzn3kYRfZdf6H90OwxWEAPKOpxWDVmp7y5Z63sjA+tK B4dg1Pa7j9+ojuyPCsu8G7Cag9yc/fWbs1Xw6xVXzsakfVoLPIudjbdlaitZXGVLRL2c s5tU7UvKuuKrT+h5CvAvBKTnnooddxU/nOfEGlxTrjHsL2GaV9kBmmcJHCuVvgKSaXVl +GGDJpt62/iffu72Ie/ZuhmgW4K9nt87vqM8zbXB4vwg9LtwUxfYCNESbJroNM2DxUyV vabOc9YwpVgB79RXkXsGLWpEp+wg7ojfhH/fK4hZcmRIdQVA6r96nNfs8KCyDkcC89Yw I9TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776067970; x=1776672770; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=nyoodP8vqkF/vXwMMM18I+0DFbSTH1wXaH4sVIn9OTo=; b=JVhPVpPqib1nDb0YgI80eXlcxY0lehkWiGOoW6bKoXsZrdrJvcK4aQ7KGNVctXI+N+ rYsVr6dCTCRyFVIaF3D03QwC9X2xFCkmQOAWG4FB6ZhBvWkf5qhTu/yxj1gGkkfBT5UA 23BipemGJkJstKf8+7EUr2swlxDSbZvRnnfF/vhmh4jbiaiqN5NFTOEsn5jmSW1lKGsd D3g7ni3B3ZGst3wjchVcorfosS1mmOny8HQgTBNJKTL9nhMyxKnuKerl3ZMc5qELG9dx 4G6kZNr4UfF17N11NKMBrIAwBS88NKsApMXSfOmRK9mij0bHTyTsNlViJklURPwW++I1 qWxA== X-Forwarded-Encrypted: i=1; AFNElJ+ZXMfWfcB/gXJN9R9HmGrHOfJCYJ8SsJ2pScvy90IceLpJ4WaldrelbtAryyx7L1ukWqU2s0xF+DlB7+E=@vger.kernel.org X-Gm-Message-State: AOJu0YySSj1xxtMGBkivwKqsclwDcq7HLjHY8j6ETyucZlsj7CItlSFo 6esndH80gRLcSm8SUQwSDE/r3ev6E/Tj3EhDjUdXTTvugilU9DpESU30 X-Gm-Gg: AeBDieurMo0YGc/t8JXejA9lxdG0Fi4+MTGvsplVOqit9spo6UVm2QZVGe9Nz4BaHWV 08haRC9FVSGFCPhSF91N4DeTlX6Jxbb9+bFAjkXxVPA+CTci0uWTkuEoOsw/FPiJU4gL0MASE1G EiNmy4++Fa5Vt8UT+7dU07I61LfhfSjtdepqC457/Ifc5Ulf92r0ifA40ZZypmz6uNXeYnpZYNk lF2gsi4roucKk7ZC2+/wAnTyQFzF1it6tSMVfNyk/M/SFibLtWWoBwYN41QiKBB7ljey+g+lJlS 9FKuEIORdksgUBSNcXbZNc8O1fv0LeJDHvLjZF5xH2nTLX1YZvRlzt5FcMqgDlHl/1OyKFlH1Tn Q/I/dJTzgL6jjKcl9/Ry8c9SUUGLnIeIh3kWcMPQl1W7I2NajNzDKMI7Cr0QSAlzF1Om3lVuyQa bRxfJ2j9ay38z7eThIg2vR X-Received: by 2002:a05:6a00:6ca2:b0:829:6f7d:3086 with SMTP id d2e1a72fcca58-82f0d10b638mr9335907b3a.11.1776067969577; Mon, 13 Apr 2026 01:12:49 -0700 (PDT) Received: from lgs.. ([101.76.249.61]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f0c4b5a79sm11026725b3a.30.2026.04.13.01.12.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 01:12:49 -0700 (PDT) From: Guangshuo Li To: Greg Kroah-Hartman , Marco Crivellari , Johan Hovold , Jiri Kosina , William Wu , Yuhao Jiang , Ben Hoff , Terry Junge , Guangshuo Li , Andrzej Pietrasiewicz , John Keeping , Lee Jones , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: [PATCH v2] usb: gadget: f_hid: fix device reference leak in hidg_alloc() Date: Mon, 13 Apr 2026 16:12:37 +0800 Message-ID: <20260413081237.2677048-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hidg_alloc() initializes hidg->dev with device_initialize() before calling dev_set_name(). If dev_set_name() fails, the function currently jumps to err_unlock and returns without calling put_device(). This leaves the device reference unbalanced and prevents hidg_release() from being called. Calling put_device() here is also safe, since hidg_release() only frees resources owned by hidg. Route the dev_set_name() failure path through err_put_device so the device reference is dropped properly. Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev") Cc: stable@vger.kernel.org Reviewed-by: Johan Hovold Signed-off-by: Guangshuo Li --- v2: - correct Fixes tag to 89ff3dfac604 - add Reviewed-by from Johan Hovold drivers/usb/gadget/function/f_hid.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/funct= ion/f_hid.c index 3ddfd4f66f0b..2734ebd35bda 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1610,7 +1610,7 @@ static struct usb_function *hidg_alloc(struct usb_fun= ction_instance *fi) hidg->dev.devt =3D MKDEV(major, opts->minor); ret =3D dev_set_name(&hidg->dev, "hidg%d", opts->minor); if (ret) - goto err_unlock; + goto err_put_device; =20 hidg->bInterfaceSubClass =3D opts->subclass; hidg->bInterfaceProtocol =3D opts->protocol; @@ -1647,7 +1647,6 @@ static struct usb_function *hidg_alloc(struct usb_fun= ction_instance *fi) =20 err_put_device: put_device(&hidg->dev); -err_unlock: mutex_unlock(&opts->lock); return ERR_PTR(ret); } --=20 2.43.0