On Thu, Jul 31, 2025 at 03:19:19AM +0100, Salah Triki wrote: > The driver stores a reference to the `usb_device` structure (`udev`) > in its private data (`data->udev`), which can persist beyond the > immediate context of the `bfusb_probe()` function. > > Without proper reference count management, this can lead to two issues: > > 1. A `use-after-free` scenario if `udev` is accessed after its main > reference count drops to zero (e.g., if the device is disconnected > and the `data` structure is still active). How can that happen as during the probe/remove cycle, the reference count is always properly incremetned. > 2. A `memory leak` if `udev`'s reference count is not properly > decremented during driver disconnect, preventing the `usb_device` > object from being freed. There is no leak here at all, sorry. > To correctly manage the `udev` lifetime, explicitly increment its > reference count with `usb_get_dev(udev)` when storing it in the > driver's private data. Correspondingly, decrement the reference count > with `usb_put_dev(data->udev)` in the `bfusb_disconnect()` callback. > > This ensures `udev` remains valid while referenced by the driver's > private data and is properly released when no longer needed. How was this tested? I'm not saying the change is wrong, just that I don't think it's actually a leak, or fix of anything real. Or do you have a workload that shows this is needed? If so, what is the crash reported? thanks, greg k-h
