For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] usb: core: fix memory leak in usb_new_device() error path
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


When usb_new_device() fails, it jumps to the 'fail' label which calls
pm_runtime_disable() but never balances the earlier
pm_runtime_get_noresume() call made at the top of the function.

This leaves the PM runtime usage count elevated, preventing
usb_put_dev() in hub_port_connect() from dropping the refcount to zero.
As a result, usb_release_dev() never fires and usb_destroy_configuration()
is never called, leaking all memory allocated during enumeration:

  - struct usb_device          (2048 bytes) via usb_alloc_dev()
  - raw config descriptor      (1024 bytes) via usb_get_configuration()
  - config metadata            (   8 bytes) via usb_get_configuration()
  - interface descriptor       (  64 bytes) via usb_parse_configuration()
  - struct device_private      ( 256 bytes) via device_private_init()

Fix this by adding pm_runtime_put_noidle() on the fail path to balance
the pm_runtime_get_noresume() at the top of the function.
pm_runtime_put_noidle() is correct here rather than pm_runtime_put()
because we are in a teardown path and must not trigger autosuspend
scheduling.

Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2afd7e71155c7e241560
Signed-off-by: Deepanshu kartikey <kartikey406@gmail.com>
---
 drivers/usb/core/hub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 24960ba9caa9..148fadfbc30b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2733,6 +2733,7 @@ int usb_new_device(struct usb_device *udev)
 	usb_set_device_state(udev, USB_STATE_NOTATTACHED);
 	pm_runtime_disable(&udev->dev);
 	pm_runtime_set_suspended(&udev->dev);
+	pm_runtime_put_noidle(&udev->dev);
 	return err;
 }
 
-- 
2.43.0