linux-kernel - Re: [PATCH] usb: xhci: Fix memory leak in xchi_disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2026010804-commuting-hardly-0204@gregkh>
Date: Thu, 8 Jan 2026 06:42:51 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Zilin Guan <zilin@....edu.cn>
Cc: jianhao.xu@....edu.cn, linux-kernel@...r.kernel.org,
	linux-usb@...r.kernel.org, mathias.nyman@...el.com
Subject: Re: [PATCH] usb: xhci: Fix memory leak in xchi_disable_slot()

On Thu, Jan 08, 2026 at 02:37:10AM +0000, Zilin Guan wrote:
> On Wed, Jan 07, 2026 at 04:04:43PM +0100, Greg KH wrote:
> > On Thu, Dec 25, 2025 at 04:21:19PM +0000, Zilin Guan wrote:
> > > xhci_alloc_command() allocates a command structure and, when the
> > > second argument is true, also allocates a completion structure.
> > > Currently, the error handling path in xhci_disable_slot() only frees
> > > the command structure using kfree(), causing the completion structure
> > > to leak.
> > > 
> > > Fix this by using xhci_free_command() instead of kfree(). This function
> > > correctly frees both the command and the completion structure.
> > > 
> > > Fixes: cd3f1790b006d ("usb: xhci: Fix potential memory leak in xhci_disable_slot()")
> > 
> > No cc: stable?
> 
> My understanding is that the Cc: stable tag is primarily intended for 
> severe bugs. I wasn't sure if this leak was critical enough to warrant 
> backporting, especially since the amount of leaked memory is small. I 
> decided to avoid adding unnecessary noise to the stable tree, but I am 
> happy to include the tag if you advise doing so.
> 
> > And how was this found?  How was it tested?  
> 
> This issue was reported by our static analysis tool, but we manually verify 
> the bugs.

As per our documentation, you need to describe the tool being used,
please read and follow that, otherwise we have no idea of what is
happening here.

thanks,

greg k-h