Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sat, 12 Mar 2022 11:02:26 -0500
From:   Alan Stern <stern@rowland.harvard.edu>
To:     Pavel Skripkin <paskripkin@gmail.com>
Cc:     syzbot <syzbot+f0fae482604e6d9a87c9@syzkaller.appspotmail.com>,
        gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
        linux-usb@vger.kernel.org, pavel.hofman@ivitera.com,
        rob@robgreener.com, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] memory leak in usb_get_configuration
Message-ID: <YizEEq6gib/FNLKr@rowland.harvard.edu>
References: <000000000000351b8605d9d1d1bf@google.com>
 <Yiu4tCONfHVH1Qfv@rowland.harvard.edu>
 <d17aef8a-adbe-9d90-3173-60eb2f0828a5@gmail.com>
 <Yiy7gEfSPZlfLHSY@rowland.harvard.edu>
 <d82e80ed-566d-9516-2cc2-60278b56ea8d@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <d82e80ed-566d-9516-2cc2-60278b56ea8d@gmail.com>
Precedence: bulk

On Sat, Mar 12, 2022 at 06:45:08PM +0300, Pavel Skripkin wrote:
> > Unfortunately, that won't tell us where the extra reference is coming
> > from.  Here's one thing you could do if you want to continue your
> > debugging: At the start of the probe routines for carl9170, usbtest, and
> > spca501, add code to print in the kernel log the reference count value
> > for the usb_device and usb_interface.  Maybe you'll be able to see where
> > the refcount goes up.
> > 
> 
> Unfortunately refcount for dev and inf stays the same at the beginning of
> each probe function:
> 
> 6 for dev
> 3 for inf

Can you find out how those numbers compare with the values for actual 
working USB devices?

Also, can you see what the device's refcount is just before the 
device_add() call in usb_new_device() and just before the put_device() 
call at the end of usb_disconnect() (both in drivers/usb/core/hub.c)?

If they all are consistent with each then my guess that something is 
failing to drop a reference is probably wrong.

Alan Stern