Forwarded: [PATCH] usb: core: hub: fix memory leak in hub_port_connect

[syzbot <syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] usb: core: hub: fix memory leak in hub_port_connect
Author: souradiptodas6@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

---
 drivers/usb/core/hub.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 24960ba9caa9..2924ce770066 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5405,6 +5405,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 		if (hcd->usb_phy && !hdev->parent)
 			usb_phy_notify_disconnect(hcd->usb_phy, udev->speed);
 		usb_disconnect(&port_dev->child);
+		udev = NULL;
 	}
 
 	/* We can forget about a "removed" device when there's a physical
@@ -5582,6 +5583,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 			goto loop_disable;
 
 		status = hub_power_remaining(hub);
+		udev = NULL;
 		if (status)
 			dev_dbg(hub->intfdev, "%dmA power budget left\n", status);
 
@@ -5624,6 +5626,8 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 		if (status != -ENOTCONN && status != -ENODEV)
 			hcd->driver->relinquish_port(hcd, port1);
 	}
+	if (udev)
+    		usb_put_dev(udev);
 }
 
 /* Handle physical or logical connection change events.
-- 
2.52.0