gadgetfs: Fix leak on error in aio_read()

The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.

This fix is not needed upstream as that error path was removed
by commit 7fe3976e0f3a ('gadget: switch ep_io_operations to
->read_iter/->write_iter').

Fixes: f01d35a15fa0 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index d00b3e3..ce7253b 100644 (file)
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -648,6 +648,7 @@ fail:
 
        value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
        if (unlikely(value < 0)) {
+               kfree(priv->iv);
                kfree(priv);
                goto fail;
        }