From: kernel test robot <lkp@intel.com>
To: Oliver Neukum <oneukum@suse.com>,
syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Cc: oe-kbuild-all@lists.linux.dev, linux-usb@vger.kernel.org,
tiwai@suse.com, Oliver Neukum <oneukum@suse.com>
Subject: Re: [PATCH] sound: usb: caiaq: fix reference leak in probe error
Date: Wed, 29 Apr 2026 21:42:53 +0200 [thread overview]
Message-ID: <202604292126.d4xbRC4p-lkp@intel.com> (raw)
In-Reply-To: <20260429104527.19927-1-oneukum@suse.com>
Hi Oliver,
kernel test robot noticed the following build errors:
[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus usb/usb-testing usb/usb-next usb/usb-linus westeri-thunderbolt/next peter-chen-usb/for-usb-next linus/master v7.1-rc1 next-20260429]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Oliver-Neukum/sound-usb-caiaq-fix-reference-leak-in-probe-error/20260429-205539
base: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link: https://lore.kernel.org/r/20260429104527.19927-1-oneukum%40suse.com
patch subject: [PATCH] sound: usb: caiaq: fix reference leak in probe error
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260429/202604292126.d4xbRC4p-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260429/202604292126.d4xbRC4p-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604292126.d4xbRC4p-lkp@intel.com/
All error/warnings (new ones prefixed by >>):
sound/usb/caiaq/device.c: In function 'init_card':
>> sound/usb/caiaq/device.c:534:2: warning: label 'err_dev_put' defined but not used [-Wunused-label]
534 | err_dev_put:
| ^~~~~~~~~~~
>> sound/usb/caiaq/device.c:475:17: error: label 'dev_err_put' used but not defined
475 | goto dev_err_put;
| ^~~~
vim +/dev_err_put +475 sound/usb/caiaq/device.c
434
435 static int init_card(struct snd_usb_caiaqdev *cdev)
436 {
437 char *c, usbpath[32];
438 struct usb_device *usb_dev = cdev->chip.dev;
439 struct snd_card *card = cdev->chip.card;
440 struct device *dev = caiaqdev_to_dev(cdev);
441 int err, len;
442
443 if (usb_set_interface(usb_dev, 0, 1) != 0) {
444 dev_err(dev, "can't set alt interface.\n");
445 err = -EIO;
446 goto dev_err_put;
447 }
448
449 usb_init_urb(&cdev->ep1_in_urb);
450 usb_init_urb(&cdev->midi_out_urb);
451
452 usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev,
453 usb_rcvbulkpipe(usb_dev, 0x1),
454 cdev->ep1_in_buf, EP1_BUFSIZE,
455 usb_ep1_command_reply_dispatch, cdev);
456
457 usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev,
458 usb_sndbulkpipe(usb_dev, 0x1),
459 cdev->midi_out_buf, EP1_BUFSIZE,
460 snd_usb_caiaq_midi_output_done, cdev);
461
462 /* sanity checks of EPs before actually submitting */
463 if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
464 usb_urb_ep_type_check(&cdev->midi_out_urb)) {
465 dev_err(dev, "invalid EPs\n");
466 err = -EINVAL;
467 goto dev_err_put;
468 }
469
470 init_waitqueue_head(&cdev->ep1_wait_queue);
471 init_waitqueue_head(&cdev->prepare_wait_queue);
472
473 if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) {
474 err = -EIO;
> 475 goto dev_err_put;
476 }
477
478
479 err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
480 if (err)
481 goto err_kill_urb;
482
483 if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
484 err = -ENODEV;
485 goto err_kill_urb;
486 }
487
488 usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
489 cdev->vendor_name, CAIAQ_USB_STR_LEN);
490
491 usb_string(usb_dev, usb_dev->descriptor.iProduct,
492 cdev->product_name, CAIAQ_USB_STR_LEN);
493
494 strscpy(card->driver, MODNAME, sizeof(card->driver));
495 strscpy(card->shortname, cdev->product_name, sizeof(card->shortname));
496 strscpy(card->mixername, cdev->product_name, sizeof(card->mixername));
497
498 /* if the id was not passed as module option, fill it with a shortened
499 * version of the product string which does not contain any
500 * whitespaces */
501
502 if (*card->id == '\0') {
503 char id[sizeof(card->id)];
504
505 memset(id, 0, sizeof(id));
506
507 for (c = card->shortname, len = 0;
508 *c && len < sizeof(card->id) - 1; c++)
509 if (*c != ' ')
510 id[len++] = *c;
511
512 snd_card_set_id(card, id);
513 }
514
515 usb_make_path(usb_dev, usbpath, sizeof(usbpath));
516 scnprintf(card->longname, sizeof(card->longname), "%s %s (%s)",
517 cdev->vendor_name, cdev->product_name, usbpath);
518
519 card->private_free = card_free;
520 err = setup_card(cdev);
521 if (err < 0)
522 return err;
523
524 return 0;
525
526 err_kill_urb:
527 usb_kill_urb(&cdev->ep1_in_urb);
528
529 /*
530 * private_free has not been set.
531 * Undoing the usb_get_dev() from
532 * create_card()
533 */
> 534 err_dev_put:
535 usb_put_dev(usb_dev);
536 return err;
537 }
538
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2026-04-29 19:43 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-25 2:12 [syzbot] [usb?] memory leak in hub_event (4) syzbot
2026-04-25 6:36 ` Forwarded: [PATCH] usb: core: fix memory leak in usb_new_device() error path syzbot
2026-04-25 7:52 ` Forwarded: [PATCH] ALSA: caiaq: fix usb_dev refcount leak on probe failure syzbot
2026-04-25 8:58 ` Forwarded: [PATCH] usb: core: hub: fix memory leak in hub_port_connect syzbot
2026-04-25 9:36 ` syzbot
2026-04-25 12:54 ` Forwarded: [PATCH] ALSA: caiaq: fix usb_dev refcount leak on probe failure syzbot
2026-04-25 14:43 ` syzbot
2026-04-26 2:33 ` Hillf Danton
2026-04-27 11:40 ` [syzbot] [usb?] memory leak in hub_event (4) Oliver Neukum
2026-04-27 12:37 ` syzbot
2026-04-27 14:19 ` Alan Stern
2026-04-28 11:33 ` Oliver Neukum
2026-04-28 15:12 ` Alan Stern
2026-04-29 10:42 ` [PATCH] usb: core: hcd: fix possible deadlock in rh control transfers Oliver Neukum
2026-04-29 19:04 ` Alan Stern
2026-04-29 19:13 ` Oliver Neukum
2026-04-29 19:18 ` Alan Stern
2026-04-29 10:45 ` [PATCH] sound: usb: caiaq: fix reference leak in probe error Oliver Neukum
2026-04-29 10:53 ` Takashi Iwai
2026-04-29 11:05 ` Oliver Neukum
2026-04-29 19:42 ` kernel test robot [this message]
2026-04-30 5:33 ` kernel test robot
2026-04-30 11:02 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202604292126.d4xbRC4p-lkp@intel.com \
--to=lkp@intel.com \
--cc=linux-usb@vger.kernel.org \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oneukum@suse.com \
--cc=syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.