Forwarded: [PATCH] usb: core: fix memory leak in usb_new_device() error path

syzbot
2026-04-25T06:36:38Z

Subject: [PATCH] usb: core: fix memory leak in usb_new_device() error path
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When usb_new_device() fails, it jumps to the 'fail' label which calls
pm_runtime_disable() but never balances the earlier
pm_runtime_get_noresume() call made at the top of the function.

This leaves the PM runtime usage count elevated, preventing
usb_put_dev() in hub_port_connect() from dropping the refcount to zero.
As a result, usb_release_dev() never fires and usb_destroy_configuration()
is never called, leaking all memory allocated during enumeration:

- struct usb_device (2048 bytes) via usb_alloc_dev()
- raw config descriptor (1024 bytes) via usb_get_configuration()
- config metadata ( 8 bytes) via usb_get_configuration()
- interface descriptor ( 64 bytes) via usb_parse_configuration()
- struct device_private ( 256 bytes) via device_private_init()

Fix this by adding pm_runtime_put_noidle() on the fail path to balance
the pm_runtime_get_noresume() at the top of the function.
pm_runtime_put_noidle() is correct here rather than pm_runtime_put()
because we are in a teardown path and must not trigger autosuspend
scheduling.

Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2afd7e71155c7e241560
Signed-off-by: Deepanshu kartikey <kartikey406@gmail.com>
---
drivers/usb/core/hub.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 24960ba9caa9..148fadfbc30b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2733,6 +2733,7 @@ int usb_new_device(struct usb_device *udev)
usb_set_device_state(udev, USB_STATE_NOTATTACHED);
pm_runtime_disable(&udev->dev);
pm_runtime_set_suspended(&udev->dev);
+ pm_runtime_put_noidle(&udev->dev);
return err;
}

--
2.43.0