uvc_alloc() gets a reference on the streaming header item with config_group_find_item(). If the header is not linked to a streaming interface the function returns -EBUSY after freeing uvc, so uvc_free() never runs and the reference is leaked. Drop it before returning. Fixes: 3180d827c807 ("usb: gadget: uvc: don't put item still in use") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/usb/gadget/function/f_uvc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c index 8d404d88391c..eb5837b17e6b 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -1126,6 +1126,7 @@ static struct usb_function *uvc_alloc(struct usb_function_instance *fi) uvc->header = to_uvcg_streaming_header(h); if (!uvc->header->linked) { + config_item_put(h); mutex_unlock(&opts->lock); kfree(uvc); return ERR_PTR(-EBUSY); -- 2.34.1