From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1422678AbdD1IgF (ORCPT ); Fri, 28 Apr 2017 04:36:05 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:56096 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S968927AbdD1Ifk (ORCPT ); Fri, 28 Apr 2017 04:35:40 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Arnd Bergmann Subject: [PATCH 3.18 18/47] gadgetfs: fix uninitialized variable in error handling Date: Fri, 28 Apr 2017 10:32:31 +0200 Message-Id: <20170428083039.114853901@linuxfoundation.org> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170428083038.327543269@linuxfoundation.org> References: <20170428083038.327543269@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnd Bergmann gcc warns about a bug in 3.18.y: drivers/usb/gadget/legacy/inode.c:648:10: warning: 'value' may be used This is caused by the backport of f01d35a15fa0416 from 4.0 to 3.18: c81fc59be42c6e0 gadgetfs: use-after-free in ->aio_read() The backported patch was buggy, but the mainline code was rewritten in a larger patch directly following this one in a way that fixed the bug. For stable, we should need only a one-line change to make sure we return an proper error code. It is very unlikely that anybody ever ran into the out-of-memory case here in practice, but the compiler is right in theory. Fixes: c81fc59be42c ("gadgetfs: use-after-free in ->aio_read()") Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/legacy/inode.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -654,6 +654,7 @@ fail: GFP_KERNEL); if (!priv->iv) { kfree(priv); + value = -ENOMEM; goto fail; } }