public inbox for linux-usb@vger.kernel.org
 help / color / mirror / Atom feed
From: Oliver Neukum <oneukum@suse.com>
To: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Cc: linux-usb@vger.kernel.org, tiwai@suse.com,
	Oliver Neukum <oneukum@suse.com>
Subject: [PATCH] sound: usb: caiaq: fix reference leak in probe error
Date: Wed, 29 Apr 2026 12:45:24 +0200	[thread overview]
Message-ID: <20260429104527.19927-1-oneukum@suse.com> (raw)
In-Reply-To: <69ec231a.a00a0220.7773.000c.GAE@google.com>

If probing a device fails early a reference to a device
is leaked.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
 sound/usb/caiaq/device.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 8af0c04041ee..1a9ddbdc2cd1 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -442,7 +442,8 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
 	if (usb_set_interface(usb_dev, 0, 1) != 0) {
 		dev_err(dev, "can't set alt interface.\n");
-		return -EIO;
+		err = -EIO;
+		goto dev_err_put;
 	}
 
 	usb_init_urb(&cdev->ep1_in_urb);
@@ -462,14 +463,18 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 	if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
 	    usb_urb_ep_type_check(&cdev->midi_out_urb)) {
 		dev_err(dev, "invalid EPs\n");
-		return -EINVAL;
+		err = -EINVAL;
+		goto dev_err_put;
 	}
 
 	init_waitqueue_head(&cdev->ep1_wait_queue);
 	init_waitqueue_head(&cdev->prepare_wait_queue);
 
-	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0)
-		return -EIO;
+	if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) {
+		err = -EIO;
+		goto dev_err_put;
+	}
+
 
 	err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
 	if (err)
@@ -520,6 +525,14 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
  err_kill_urb:
 	usb_kill_urb(&cdev->ep1_in_urb);
+
+	/*
+ 	 * private_free has not been set.
+	 * Undoing the usb_get_dev() from
+	 * create_card()
+	 */
+ err_dev_put:
+	usb_put_dev(usb_dev);
 	return err;
 }
 
-- 
2.54.0


  parent reply	other threads:[~2026-04-29 10:45 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-25  2:12 [syzbot] [usb?] memory leak in hub_event (4) syzbot
2026-04-27 11:40 ` Oliver Neukum
2026-04-27 12:37   ` syzbot
2026-04-27 14:19   ` Alan Stern
2026-04-28 11:33     ` Oliver Neukum
2026-04-28 15:12       ` Alan Stern
2026-04-29 10:42 ` [PATCH] usb: core: hcd: fix possible deadlock in rh control transfers Oliver Neukum
2026-04-29 19:04   ` Alan Stern
2026-04-29 19:13     ` Oliver Neukum
2026-04-29 19:18       ` Alan Stern
2026-04-29 10:45 ` Oliver Neukum [this message]
2026-04-29 10:53   ` [PATCH] sound: usb: caiaq: fix reference leak in probe error Takashi Iwai
2026-04-29 11:05     ` Oliver Neukum
2026-04-29 19:42   ` kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260429104527.19927-1-oneukum@suse.com \
    --to=oneukum@suse.com \
    --cc=linux-usb@vger.kernel.org \
    --cc=syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com \
    --cc=tiwai@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox