tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free

geth_alloc() increments the reference count, but geth_free() fails to
decrement it. This prevents the configuration of attributes via configfs
after unlinking the function.

Decrement the reference count in geth_free() to ensure proper cleanup.

Fixes: 02832e56f88a ("usb: gadget: f_subset: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-1-4886b578161b@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Kuen-Han Tsai and committed by
Greg Kroah-Hartman caa27923 269c2646

+6
+6
drivers/usb/gadget/function/f_subset.c
··· 6 6 * Copyright (C) 2008 Nokia Corporation 7 7 */ 8 8 9 + #include <linux/cleanup.h> 9 10 #include <linux/slab.h> 10 11 #include <linux/kernel.h> 11 12 #include <linux/module.h> ··· 450 449 static void geth_free(struct usb_function *f) 451 450 { 452 451 struct f_gether *eth; 452 + struct f_gether_opts *opts; 453 + 454 + opts = container_of(f->fi, struct f_gether_opts, func_inst); 453 455 454 456 eth = func_to_geth(f); 457 + scoped_guard(mutex, &opts->lock) 458 + opts->refcnt--; 455 459 kfree(eth); 456 460 } 457 461