[PATCH] usb: host: Fix companion leak in usb_enable_intel_xhci_ports()

[PATCH] usb: host: Fix companion leak in usb_enable_intel_xhci_ports()

[Wentao Liang]

usb_enable_intel_xhci_ports() iterates over the PCI devices with
for_each_pci_dev() to check whether an Intel EHCI companion exists and
breaks out of the loop as soon as one is found. for_each_pci_dev()
takes a reference on the device returned by pci_get_device(), and
breaking out of the loop leaves that reference held. The companion
pointer is only used to set the ehci_found flag and the reference is
never dropped, leaking a reference to the EHCI companion device on
every port switch operation.

Drop the reference with pci_dev_put() once the lookup is done. When no
companion is found the loop leaves companion set to NULL, for which
pci_dev_put() is a no-op.

Fixes: 26b76798e050 ("Intel xhci: refactor EHCI/xHCI port switching")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/host/pci-quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 0404489c2f6a..bde5bc248d45 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -1076,6 +1076,8 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
 			break;
 		}
 	}
+	/* for_each_pci_dev() takes a reference on the found companion */
+	pci_dev_put(companion);
 
 	if (!ehci_found)
 		return;
-- 
2.34.1

Re: [PATCH] usb: host: Fix companion leak in usb_enable_intel_xhci_ports()

[Mathias Nyman]

On 9/16/26 19:48, Wentao Liang wrote:
> usb_enable_intel_xhci_ports() iterates over the PCI devices with
> for_each_pci_dev() to check whether an Intel EHCI companion exists and
> breaks out of the loop as soon as one is found. for_each_pci_dev()
> takes a reference on the device returned by pci_get_device(), and
> breaking out of the loop leaves that reference held. The companion
> pointer is only used to set the ehci_found flag and the reference is
> never dropped, leaking a reference to the EHCI companion device on
> every port switch operation.
> 
> Drop the reference with pci_dev_put() once the lookup is done. When no
> companion is found the loop leaves companion set to NULL, for which
> pci_dev_put() is a no-op.
> 
> Fixes: 26b76798e050 ("Intel xhci: refactor EHCI/xHCI port switching")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/usb/host/pci-quirks.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
> index 0404489c2f6a..bde5bc248d45 100644
> --- a/drivers/usb/host/pci-quirks.c
> +++ b/drivers/usb/host/pci-quirks.c
> @@ -1076,6 +1076,8 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
>   			break;
>   		}
>   	}
> +	/* for_each_pci_dev() takes a reference on the found companion */
> +	pci_dev_put(companion);
>   
>   	if (!ehci_found)
>   		return;

pci_dev_put() should only be called if we break out of the loop, i.e when ehci_found == true.

Moving pci_dev_put() a couple lines lower, after the if (!ehci_found) check should work.

Thanks
Mathias