[PATCH] USB: misc: uss720: fix refcount leak in submit_async_request()

[PATCH] USB: misc: uss720: fix refcount leak in submit_async_request()

[WenTao Liang]

When submit_async_request()'s call to usb_submit_urb() fails, the
error path directly calls destroy_async() on the request structure
instead of kref_put(). This bypasses the reference counting mechanism
because the kref is initialized to 1 and the preceding kref_get()
increments it to 2. The callback function async_complete() will never
run in this case, so the reference acquired by kref_get() is leaked,
and the structure is freed while still holding two references.

Fix by replacing destroy_async() with kref_put() in the failure
branch, properly releasing the extra reference.

Cc: stable@vger.kernel.org
Fixes: adaa3c6342b2 ("USB: uss720 fixup refcount position")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/misc/uss720.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index b7d3c44b970e..e1eba3cbef0a 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -168,7 +168,7 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
 	ret = usb_submit_urb(rq->urb, mem_flags);
 	if (!ret)
 		return rq;
-	destroy_async(&rq->ref_count);
+	kref_put(&rq->ref_count, destroy_async);
 	dev_err(&usbdev->dev, "submit_async_request submit_urb failed with %d\n", ret);
 	return NULL;
 }
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] USB: misc: uss720: fix refcount leak in submit_async_request()

[Greg KH]

On Thu, Jun 11, 2026 at 09:29:52PM +0800, WenTao Liang wrote:
> When submit_async_request()'s call to usb_submit_urb() fails, the
> error path directly calls destroy_async() on the request structure
> instead of kref_put(). This bypasses the reference counting mechanism
> because the kref is initialized to 1 and the preceding kref_get()
> increments it to 2. The callback function async_complete() will never
> run in this case, so the reference acquired by kref_get() is leaked,
> and the structure is freed while still holding two references.
> 
> Fix by replacing destroy_async() with kref_put() in the failure
> branch, properly releasing the extra reference.
> 
> Cc: stable@vger.kernel.org
> Fixes: adaa3c6342b2 ("USB: uss720 fixup refcount position")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/misc/uss720.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
> index b7d3c44b970e..e1eba3cbef0a 100644
> --- a/drivers/usb/misc/uss720.c
> +++ b/drivers/usb/misc/uss720.c
> @@ -168,7 +168,7 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
>  	ret = usb_submit_urb(rq->urb, mem_flags);
>  	if (!ret)
>  		return rq;
> -	destroy_async(&rq->ref_count);
> +	kref_put(&rq->ref_count, destroy_async);

As
https://sashiko.dev/#/patchset/20260611132952.83931-1-vulab@iscas.ac.cn
shows, this creates a new bug :(