diff options
| author | Kuen-Han Tsai <khtsai@google.com> | 2025-09-16 16:21:37 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-09-17 12:44:53 +0200 |
| commit | 08228941436047bdcd35a612c1aec0912a29d8cd (patch) | |
| tree | 806dfa14beb4c110c78f6a58a47823b1af4680e0 /drivers/infiniband/hw/ionic/ionic_ibdev.c | |
| parent | 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5 (diff) | |
usb: gadget: f_rndis: Refactor bind path to use __free()
After an bind/unbind cycle, the rndis->notify_req is left stale. If a
subsequent bind fails, the unified error label attempts to free this
stale request, leading to a NULL pointer dereference when accessing
ep->ops->free_request.
Refactor the error handling in the bind path to use the __free()
automatic cleanup mechanism.
Fixes: 45fe3b8e5342 ("usb ethernet gadget: split RNDIS function")
Cc: stable@kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://lore.kernel.org/r/20250916-ready-v1-6-4997bf277548@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250916-ready-v1-6-4997bf277548@google.com
Diffstat (limited to 'drivers/infiniband/hw/ionic/ionic_ibdev.c')
0 files changed, 0 insertions, 0 deletions