Re: [syzbot] [usb?] memory leak in hub_event (4)

[Oliver Neukum <oneukum@suse.com>]

[-- Attachment #1: Type: text/plain, Size: 81 bytes --]

On 25.04.26 04:12, syzbot wrote:

#syz test: git://repo/address.git dd6c438c3e64

[-- Attachment #2: 0001-usb-core-fix-memory-of-error-case-in-usb_get_configu.patch --]
[-- Type: text/x-patch, Size: 1527 bytes --]

From 001175f4d2e1c2ceac98b4af2521fc4d0253d0c8 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 27 Apr 2026 13:35:38 +0200
Subject: [PATCH] usb: core: fix memory of error case in usb_get_configuration

Prior allocations need to be reversed if subsequent
allocations fail.

Fixes: dd2057e544dc9 ("USB: core: drop OOM message")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
---
 drivers/usb/core/config.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 417140b012bb..67475ff81641 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -944,11 +944,11 @@ int usb_get_configuration(struct usb_device *dev)
 	length = ncfg * sizeof(char *);
 	dev->rawdescriptors = kzalloc(length, GFP_KERNEL);
 	if (!dev->rawdescriptors)
-		return -ENOMEM;
+		goto bailout2;
 
 	desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL);
 	if (!desc)
-		return -ENOMEM;
+		goto bailout;
 
 	for (cfgno = 0; cfgno < ncfg; cfgno++) {
 		/* We grab just the first descriptor so we know how long
@@ -1012,6 +1012,15 @@ int usb_get_configuration(struct usb_device *dev)
 	dev->descriptor.bNumConfigurations = cfgno;
 
 	return result;
+
+bailout:
+	kfree(dev->rawdescriptors);
+	dev->rawdescriptors = NULL;
+bailout2:
+	kfree(dev->config);
+	dev->config = NULL;
+
+	return -ENOMEM;
 }
 
 void usb_release_bos_descriptor(struct usb_device *dev)
-- 
2.54.0