Commit caa27923 authored by Kuen-Han Tsai's avatar Kuen-Han Tsai Committed by Greg Kroah-Hartman
Browse files

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free 



geth_alloc() increments the reference count, but geth_free() fails to
decrement it. This prevents the configuration of attributes via configfs
after unlinking the function.

Decrement the reference count in geth_free() to ensure proper cleanup.

Fixes: 02832e56 ("usb: gadget: f_subset: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarKuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-1-4886b578161b@google.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 269c2646

drivers/usb/gadget/function/f_subset.c

+6 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
 * Copyright (C) 2008 Nokia Corporation

 */



#include <linux/cleanup.h>

#include <linux/slab.h>

#include <linux/kernel.h>

#include <linux/module.h>
@@ -449,8 +450,13 @@ static struct usb_function_instance *geth_alloc_inst(void) 
static void geth_free(struct usb_function *f)

{

	struct f_gether *eth;

	struct f_gether_opts *opts;



	opts = container_of(f->fi, struct f_gether_opts, func_inst);



	eth = func_to_geth(f);

	scoped_guard(mutex, &opts->lock)

		opts->refcnt--;

	kfree(eth);

}