From: Oliver Neukum <oneukum@suse.com>
To: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Cc: linux-usb@vger.kernel.org, tiwai@suse.com,
Oliver Neukum <oneukum@suse.com>
Subject: [PATCH] sound: usb: caiaq: fix reference leak in probe error
Date: Wed, 29 Apr 2026 12:45:24 +0200 [thread overview]
Message-ID: <20260429104527.19927-1-oneukum@suse.com> (raw)
In-Reply-To: <69ec231a.a00a0220.7773.000c.GAE@google.com>
If probing a device fails early a reference to a device
is leaked.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
sound/usb/caiaq/device.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 8af0c04041ee..1a9ddbdc2cd1 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -442,7 +442,8 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
if (usb_set_interface(usb_dev, 0, 1) != 0) {
dev_err(dev, "can't set alt interface.\n");
- return -EIO;
+ err = -EIO;
+ goto dev_err_put;
}
usb_init_urb(&cdev->ep1_in_urb);
@@ -462,14 +463,18 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
usb_urb_ep_type_check(&cdev->midi_out_urb)) {
dev_err(dev, "invalid EPs\n");
- return -EINVAL;
+ err = -EINVAL;
+ goto dev_err_put;
}
init_waitqueue_head(&cdev->ep1_wait_queue);
init_waitqueue_head(&cdev->prepare_wait_queue);
- if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
- return -EIO;
+ if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) {
+ err = -EIO;
+ goto dev_err_put;
+ }
+
err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
if (err)
@@ -520,6 +525,14 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
err_kill_urb:
usb_kill_urb(&cdev->ep1_in_urb);
+
+ /*
+ * private_free has not been set.
+ * Undoing the usb_get_dev() from
+ * create_card()
+ */
+ err_dev_put:
+ usb_put_dev(usb_dev);
return err;
}
--
2.54.0
next prev parent reply other threads:[~2026-04-29 10:45 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-25 2:12 [syzbot] [usb?] memory leak in hub_event (4) syzbot
2026-04-27 11:40 ` Oliver Neukum
2026-04-27 12:37 ` syzbot
2026-04-27 14:19 ` Alan Stern
2026-04-28 11:33 ` Oliver Neukum
2026-04-28 15:12 ` Alan Stern
2026-04-29 10:42 ` [PATCH] usb: core: hcd: fix possible deadlock in rh control transfers Oliver Neukum
2026-04-29 19:04 ` Alan Stern
2026-04-29 19:13 ` Oliver Neukum
2026-04-29 19:18 ` Alan Stern
2026-04-29 10:45 ` Oliver Neukum [this message]
2026-04-29 10:53 ` [PATCH] sound: usb: caiaq: fix reference leak in probe error Takashi Iwai
2026-04-29 11:05 ` Oliver Neukum
2026-04-29 19:42 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260429104527.19927-1-oneukum@suse.com \
--to=oneukum@suse.com \
--cc=linux-usb@vger.kernel.org \
--cc=syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox