[PATCH] usb: host: Fix companion leak in usb_enable_intel_xhci_ports()

[Wentao Liang <vulab@iscas.ac.cn>]

usb_enable_intel_xhci_ports() iterates over the PCI devices with
for_each_pci_dev() to check whether an Intel EHCI companion exists and
breaks out of the loop as soon as one is found. for_each_pci_dev()
takes a reference on the device returned by pci_get_device(), and
breaking out of the loop leaves that reference held. The companion
pointer is only used to set the ehci_found flag and the reference is
never dropped, leaking a reference to the EHCI companion device on
every port switch operation.

Drop the reference with pci_dev_put() once the lookup is done. When no
companion is found the loop leaves companion set to NULL, for which
pci_dev_put() is a no-op.

Fixes: 26b76798e050 ("Intel xhci: refactor EHCI/xHCI port switching")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/host/pci-quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 0404489c2f6a..bde5bc248d45 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -1076,6 +1076,8 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
 			break;
 		}
 	}
+	/* for_each_pci_dev() takes a reference on the found companion */
+	pci_dev_put(companion);
 
 	if (!ehci_found)
 		return;
-- 
2.34.1