Re: [PATCH] usb-serial: fix port device refcount leak when device_add() fails

[Guangshuo Li]

Hi Johan,

Thanks, you are right.

I had missed the disconnect path: usb_serial_disconnect() retrieves the
serial object from usb_get_intfdata(interface) and then calls
usb_serial_put(serial), which can eventually release the ports through
destroy_serial().

So this is deferred cleanup rather than a refcount leak.

This report came from a static analysis result produced by a tool I am
developing, and my review of the report here was incomplete.

Please disregard this patch.

Best regards,
Guangshuo

Johan Hovold <johan@xxxxxxxxxx> 于2026年4月13日周一 14:57写道：
>
> On Mon, Apr 13, 2026 at 12:53:11AM +0800, Guangshuo Li wrote:
> > usb_serial_probe() initializes each port device with
> > device_initialize() before registering it with device_add().
> >
> > If device_add() fails, the current code only logs an error and
> > continues, but does not drop the reference acquired by
> > device_initialize(). This leaves the failed port device referenced
> > until a later teardown path, if any.
> >
> > Fix it by calling put_device() when device_add() fails. Also clear
> > serial->port[i] after put_device() so destroy_serial() will not try
> > to put the same device again.
>
> Any port that fails to register is released in destroy_serial() which is
> called when the last reference to the device is dropped (e.g. when the
> device is disconnected).
>
> So there is nothing to fix here.
>
> Are you using some kind of tool to find these "issues"?
>
> Johan