1 files changed, 10 insertions, 2 deletions

diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index e1d5853ef1e4..c7c5b3ce1d98 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -908,6 +908,7 @@ static void rndis_free_inst(struct usb_function_instance *f)
                         free_netdev(opts->net);
         }
 
+        kfree(opts->rndis_interf_group);        /* single VLA chunk */
         kfree(opts);
 }
 
@@ -916,6 +917,7 @@ static struct usb_function_instance *rndis_alloc_inst(void)
         struct f_rndis_opts *opts;
         struct usb_os_desc *descs[1];
         char *names[1];
+        struct config_group *rndis_interf_group;
 
         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
         if (!opts)
@@ -940,8 +942,14 @@ static struct usb_function_instance *rndis_alloc_inst(void)
         names[0] = "rndis";
         config_group_init_type_name(&opts->func_inst.group, "",
                                     &rndis_func_type);
-        usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
-                                       names, THIS_MODULE);
+        rndis_interf_group =
+                usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
+                                               names, THIS_MODULE);
+        if (IS_ERR(rndis_interf_group)) {
+                rndis_free_inst(&opts->func_inst);
+                return ERR_CAST(rndis_interf_group);
+        }
+        opts->rndis_interf_group = rndis_interf_group;
 
         return &opts->func_inst;
 }