The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.
This fix is not needed upstream as that error path was removed
by commit
7fe3976e0f3a ('gadget: switch ep_io_operations to
->read_iter/->write_iter').
Fixes:
f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
if (unlikely(value < 0)) {
+ kfree(priv->iv);
kfree(priv);
goto fail;
}