All of lore.kernel.org
 help / color / mirror / Atom feed
From: kernel test robot <lkp@intel.com>
To: Oliver Neukum <oneukum@suse.com>,
	syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Cc: oe-kbuild-all@lists.linux.dev, linux-usb@vger.kernel.org,
	tiwai@suse.com, Oliver Neukum <oneukum@suse.com>
Subject: Re: [PATCH] sound: usb: caiaq: fix reference leak in probe error
Date: Wed, 29 Apr 2026 21:42:53 +0200	[thread overview]
Message-ID: <202604292126.d4xbRC4p-lkp@intel.com> (raw)
In-Reply-To: <20260429104527.19927-1-oneukum@suse.com>

Hi Oliver,

kernel test robot noticed the following build errors:

[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus usb/usb-testing usb/usb-next usb/usb-linus westeri-thunderbolt/next peter-chen-usb/for-usb-next linus/master v7.1-rc1 next-20260429]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Oliver-Neukum/sound-usb-caiaq-fix-reference-leak-in-probe-error/20260429-205539
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link:    https://lore.kernel.org/r/20260429104527.19927-1-oneukum%40suse.com
patch subject: [PATCH] sound: usb: caiaq: fix reference leak in probe error
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260429/202604292126.d4xbRC4p-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260429/202604292126.d4xbRC4p-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604292126.d4xbRC4p-lkp@intel.com/

All error/warnings (new ones prefixed by >>):

   sound/usb/caiaq/device.c: In function 'init_card':
>> sound/usb/caiaq/device.c:534:2: warning: label 'err_dev_put' defined but not used [-Wunused-label]
     534 |  err_dev_put:
         |  ^~~~~~~~~~~
>> sound/usb/caiaq/device.c:475:17: error: label 'dev_err_put' used but not defined
     475 |                 goto dev_err_put;
         |                 ^~~~


vim +/dev_err_put +475 sound/usb/caiaq/device.c

   434	
   435	static int init_card(struct snd_usb_caiaqdev *cdev)
   436	{
   437		char *c, usbpath[32];
   438		struct usb_device *usb_dev = cdev->chip.dev;
   439		struct snd_card *card = cdev->chip.card;
   440		struct device *dev = caiaqdev_to_dev(cdev);
   441		int err, len;
   442	
   443		if (usb_set_interface(usb_dev, 0, 1) != 0) {
   444			dev_err(dev, "can't set alt interface.\n");
   445			err = -EIO;
   446			goto dev_err_put;
   447		}
   448	
   449		usb_init_urb(&cdev->ep1_in_urb);
   450		usb_init_urb(&cdev->midi_out_urb);
   451	
   452		usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
   453				  usb_rcvbulkpipe(usb_dev, 0x1),
   454				  cdev->ep1_in_buf, EP1_BUFSIZE,
   455				  usb_ep1_command_reply_dispatch, cdev);
   456	
   457		usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
   458				  usb_sndbulkpipe(usb_dev, 0x1),
   459				  cdev->midi_out_buf, EP1_BUFSIZE,
   460				  snd_usb_caiaq_midi_output_done, cdev);
   461	
   462		/* sanity checks of EPs before actually submitting */
   463		if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
   464		    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
   465			dev_err(dev, "invalid EPs\n");
   466			err = -EINVAL;
   467			goto dev_err_put;
   468		}
   469	
   470		init_waitqueue_head(&cdev->ep1_wait_queue);
   471		init_waitqueue_head(&cdev->prepare_wait_queue);
   472	
   473		if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) {
   474			err = -EIO;
 > 475			goto dev_err_put;
   476		}
   477	
   478	
   479		err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
   480		if (err)
   481			goto err_kill_urb;
   482	
   483		if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
   484			err = -ENODEV;
   485			goto err_kill_urb;
   486		}
   487	
   488		usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
   489			   cdev->vendor_name, CAIAQ_USB_STR_LEN);
   490	
   491		usb_string(usb_dev, usb_dev->descriptor.iProduct,
   492			   cdev->product_name, CAIAQ_USB_STR_LEN);
   493	
   494		strscpy(card->driver, MODNAME, sizeof(card->driver));
   495		strscpy(card->shortname, cdev->product_name, sizeof(card->shortname));
   496		strscpy(card->mixername, cdev->product_name, sizeof(card->mixername));
   497	
   498		/* if the id was not passed as module option, fill it with a shortened
   499		 * version of the product string which does not contain any
   500		 * whitespaces */
   501	
   502		if (*card->id == '\0') {
   503			char id[sizeof(card->id)];
   504	
   505			memset(id, 0, sizeof(id));
   506	
   507			for (c = card->shortname, len = 0;
   508				*c && len < sizeof(card->id) - 1; c++)
   509				if (*c != ' ')
   510					id[len++] = *c;
   511	
   512			snd_card_set_id(card, id);
   513		}
   514	
   515		usb_make_path(usb_dev, usbpath, sizeof(usbpath));
   516		scnprintf(card->longname, sizeof(card->longname), "%s %s (%s)",
   517			       cdev->vendor_name, cdev->product_name, usbpath);
   518	
   519		card->private_free = card_free;
   520		err = setup_card(cdev);
   521		if (err < 0)
   522			return err;
   523	
   524		return 0;
   525	
   526	 err_kill_urb:
   527		usb_kill_urb(&cdev->ep1_in_urb);
   528	
   529		/*
   530	 	 * private_free has not been set.
   531		 * Undoing the usb_get_dev() from
   532		 * create_card()
   533		 */
 > 534	 err_dev_put:
   535		usb_put_dev(usb_dev);
   536		return err;
   537	}
   538	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

  parent reply	other threads:[~2026-04-29 19:43 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-25  2:12 [syzbot] [usb?] memory leak in hub_event (4) syzbot
2026-04-25  6:36 ` Forwarded: [PATCH] usb: core: fix memory leak in usb_new_device() error path syzbot
2026-04-25  7:52 ` Forwarded: [PATCH] ALSA: caiaq: fix usb_dev refcount leak on probe failure syzbot
2026-04-25  8:58 ` Forwarded: [PATCH] usb: core: hub: fix memory leak in hub_port_connect syzbot
2026-04-25  9:36 ` syzbot
2026-04-25 12:54 ` Forwarded: [PATCH] ALSA: caiaq: fix usb_dev refcount leak on probe failure syzbot
2026-04-25 14:43 ` syzbot
2026-04-26  2:33   ` Hillf Danton
2026-04-27 11:40 ` [syzbot] [usb?] memory leak in hub_event (4) Oliver Neukum
2026-04-27 12:37   ` syzbot
2026-04-27 14:19   ` Alan Stern
2026-04-28 11:33     ` Oliver Neukum
2026-04-28 15:12       ` Alan Stern
2026-04-29 10:42 ` [PATCH] usb: core: hcd: fix possible deadlock in rh control transfers Oliver Neukum
2026-04-29 19:04   ` Alan Stern
2026-04-29 19:13     ` Oliver Neukum
2026-04-29 19:18       ` Alan Stern
2026-04-29 10:45 ` [PATCH] sound: usb: caiaq: fix reference leak in probe error Oliver Neukum
2026-04-29 10:53   ` Takashi Iwai
2026-04-29 11:05     ` Oliver Neukum
2026-04-29 19:42   ` kernel test robot [this message]
2026-04-30  5:33   ` kernel test robot
2026-04-30 11:02   ` kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202604292126.d4xbRC4p-lkp@intel.com \
    --to=lkp@intel.com \
    --cc=linux-usb@vger.kernel.org \
    --cc=oe-kbuild-all@lists.linux.dev \
    --cc=oneukum@suse.com \
    --cc=syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com \
    --cc=tiwai@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.