[PATCH] usb: xhci: fix refcount leak in xhci_port_bw_show()

[PATCH] usb: xhci: fix refcount leak in xhci_port_bw_show()

[WenTao Liang]

If xhci_port_bw_show() calls pm_runtime_get_sync() and it fails with
a negative return value, the function returns the error directly without
calling pm_runtime_put_sync(). This leaks the runtime PM usage count,
preventing the device from ever suspending again.

pm_runtime_get_sync() unconditionally increments dev->power.usage_count
before calling rpm_resume(). If rpm_resume() fails, the usage count is
not decremented — a well-known API pitfall. Add a pm_runtime_put_sync()
call on the error path to balance the reference.

Cc: stable@vger.kernel.org
Fixes: 59d50e53e070 ("usb: xhci: Add debugfs support for xHCI port bandwidth")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/host/xhci-debugfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index d07276192256..2974411f775d 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -679,8 +679,10 @@ static int xhci_port_bw_show(struct xhci_hcd *xhci, u8 dev_speed,
 	struct device			*dev = hcd->self.controller;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		return ret;
+	}
 
 	ctx = xhci_alloc_port_bw_ctx(xhci, 0);
 	if (!ctx) {
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] usb: xhci: fix refcount leak in xhci_port_bw_show()

[Johan Hovold]

On Thu, Jun 11, 2026 at 09:21:20PM +0800, WenTao Liang wrote:
> If xhci_port_bw_show() calls pm_runtime_get_sync() and it fails with
> a negative return value, the function returns the error directly without
> calling pm_runtime_put_sync(). This leaks the runtime PM usage count,
> preventing the device from ever suspending again.

A failure to resume to the device will generally prevent the device from
ever resuming again in itself.

> pm_runtime_get_sync() unconditionally increments dev->power.usage_count
> before calling rpm_resume(). If rpm_resume() fails, the usage count is
> not decremented — a well-known API pitfall. Add a pm_runtime_put_sync()

You are using pm_runtime_put_noidle() (as you should), not _sync().

> call on the error path to balance the reference.
> 
> Cc: stable@vger.kernel.org
> Fixes: 59d50e53e070 ("usb: xhci: Add debugfs support for xHCI port bandwidth")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Again, how was this issue found?

Also, "refcount" in the summary is a bit misleading as it makes it
sounds like you're fixing a memory leak. Please use something like
"runtime pm (reference) leak" instead.

Johan