for_each_pci_dev() holds a reference to the current device.  The Intel
EHCI lookup breaks as soon as it finds a match, so the iterator does not
get a chance to drop that reference on its next iteration.

Release the reference before leaving the loop.

Fixes: 26b76798e050 ("Intel xhci: refactor EHCI/xHCI port switching")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/usb/host/pci-quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 0404489c2f6a..ba158d63bb8b 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -1073,6 +1073,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
 		if (companion->class == PCI_CLASS_SERIAL_USB_EHCI &&
 		    companion->vendor == PCI_VENDOR_ID_INTEL) {
 			ehci_found = true;
+			pci_dev_put(companion);
 			break;
 		}
 	}
-- 
2.43.0

On Thu, Aug 06, 2026 at 10:43:04PM -0400, Yuho Choi wrote:
> for_each_pci_dev() holds a reference to the current device.  The Intel
> EHCI lookup breaks as soon as it finds a match, so the iterator does not
> get a chance to drop that reference on its next iteration.
> 
> Release the reference before leaving the loop.
> 
> Fixes: 26b76798e050 ("Intel xhci: refactor EHCI/xHCI port switching")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---

Reviewed-by: Alan Stern <stern@rowland.harvard.edu>

>  drivers/usb/host/pci-quirks.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
> index 0404489c2f6a..ba158d63bb8b 100644
> --- a/drivers/usb/host/pci-quirks.c
> +++ b/drivers/usb/host/pci-quirks.c
> @@ -1073,6 +1073,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
>  		if (companion->class == PCI_CLASS_SERIAL_USB_EHCI &&
>  		    companion->vendor == PCI_VENDOR_ID_INTEL) {
>  			ehci_found = true;
> +			pci_dev_put(companion);
>  			break;
>  		}
>  	}
> -- 
> 2.43.0
> 
>