[PATCH] usb: fix reference leak in usb_new_device()

From: Ma Ke
Date: Mon Dec 16 2024 - 22:57:43 EST


When device_add(&udev->dev) failed, calling put_device() to explicitly
release udev->dev. Otherwise, it could cause double free problem.

Found by code review.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 9f8b17e643fe ("USB: make usbdevices export their device nodes instead of using a separate class")
Signed-off-by: Ma Ke <make_ruc2021@xxxxxxx>
---
drivers/usb/core/hub.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 4b93c0bd1d4b..05b778d2ad63 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2651,6 +2651,7 @@ int usb_new_device(struct usb_device *udev)
err = device_add(&udev->dev);
if (err) {
dev_err(&udev->dev, "can't device_add, error %d\n", err);
+ put_device(&udev->dev);
goto fail;
}

@@ -2683,6 +2684,9 @@ int usb_new_device(struct usb_device *udev)
pm_runtime_put_sync_autosuspend(&udev->dev);
return err;

+out_del_dev:
+ device_del(&udev->dev);
+ put_device(&udev->dev);
fail:
usb_set_device_state(udev, USB_STATE_NOTATTACHED);
pm_runtime_disable(&udev->dev);
--
2.25.1