Re: [syzbot] [usb?] memory leak in hub_event (4)

Oliver Neukum
2026-04-27T11:40:05Z

[-- Attachment #1: Type: text/plain, Size: 81 bytes --]

On 25.04.26 04:12, syzbot wrote:

#syz test: git://repo/address.git dd6c438c3e64

[-- Attachment #2: 0001-usb-core-fix-memory-of-error-case-in-usb_get_configu.patch --]
[-- Type: text/x-patch, Size: 1527 bytes --]

From 001175f4d2e1c2ceac98b4af2521fc4d0253d0c8 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 27 Apr 2026 13:35:38 +0200
Subject: [PATCH] usb: core: fix memory of error case in usb_get_configuration

Prior allocations need to be reversed if subsequent
allocations fail.

Fixes: dd2057e544dc9 ("USB: core: drop OOM message")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
---
drivers/usb/core/config.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 417140b012bb..67475ff81641 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -944,11 +944,11 @@ int usb_get_configuration(struct usb_device *dev)
length = ncfg * sizeof(char *);
dev->rawdescriptors = kzalloc(length, GFP_KERNEL);
if (!dev->rawdescriptors)
- return -ENOMEM;
+ goto bailout2;

desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL);
if (!desc)
- return -ENOMEM;
+ goto bailout;

for (cfgno = 0; cfgno < ncfg; cfgno++) {
/* We grab just the first descriptor so we know how long
@@ -1012,6 +1012,15 @@ int usb_get_configuration(struct usb_device *dev)
dev->descriptor.bNumConfigurations = cfgno;

return result;
+
+bailout:
+ kfree(dev->rawdescriptors);
+ dev->rawdescriptors = NULL;
+bailout2:
+ kfree(dev->config);
+ dev->config = NULL;
+
+ return -ENOMEM;
}

void usb_release_bos_descriptor(struct usb_device *dev)
--
2.54.0