Re: [syzbot] [usb?] memory leak in hub_event (4)

Alan Stern
2026-04-28T15:12:27Z

On Tue, Apr 28, 2026 at 01:33:20PM +0200, Oliver Neukum wrote:
>
>
> On 27.04.26 16:19, Alan Stern wrote:
> > This is not needed. dev->rawdescriptors and dev->config are deallocated
> > in usb_destroy_configuration(), which gets called when the usb_device
> > structure is released.
> >
> > The memory leak must have a different cause.
>
> You are correct. Yet I can see no way for usb_destroy_configuration()
> to not run. Hence we must be overlooking something.

Maybe the usb_device structures are not being released at all. For
instance, the snd_usb_audio or snd_usb_caiaq driver may forget to drop a
reference in an error pathway.

It seems odd that the bug report says there are 5 suspected memory leaks
right after 5 devices have disconnected, yet the tracebacks are for
different size allocations, implying that they all refer to the same
device (i.e., not the same allocation for each of the 5 devices). But
it could just be a coincidence.

Alan Stern