From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f198.google.com (mail-oi1-f198.google.com [209.85.167.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F194A3BBA09 for ; Thu, 16 Jul 2026 12:09:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.198 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784203765; cv=none; b=XOQDjDv56LxtXJ2j+n+scoHyg2SSBhK1CuYCqTeuc8my94aXsFeNk6XpaeeZCWB7h+01S3dfOYzn14joAAdtbKqkleZf3GI3MMdw/jQrMbM7z32DaEdrA4SpOv2xMSjsLQhbnDyj6FJyPa+geIJen7wJnejqngqcpst7UUmmXRY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784203765; c=relaxed/simple; bh=FuMm7XWdt1wmeD5h3dyrhMdTz8l8N2uvlnAR0HnZ5Ug=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=NR1bEJRHdRCfxkhY8ZfgIIgCiTs9wwu4Ey6f4sKfXi48faTqEIqCXSIAh2k8nCh73E9WZLKyxKZdQWa67yf0I08CZklfjJ2cnNjFEplEOaqnfezdds8KSEq+3t0yPUmXUJ8JCqrVFHsSNXN/ocwc/KBD9xpznxK6TvU/kwcmXIY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f198.google.com with SMTP id 5614622812f47-495f637105eso10458701b6e.2 for ; Thu, 16 Jul 2026 05:09:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784203762; x=1784808562; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=dEUvKGE/bCuciCLAE7ne/ujDZMf4LOrC0tX9AjWVW1w=; b=oUBFLT3je4oa8wvbLPnqRzBx4AsEaKNVTk1EKC+6U5nPiQIi++wIdTjnFYFGjLjsJy L3weqRoVvqEaY5JinC+bBQOrwrysL6EqPwkSG1/HDhLGlN7dBcrGVlofrkFc20rUfFmT vJlToelJD+7Kv0WzzpCCk04ywHcf6ZiMKooeUSx2p3a+EFxOVv5CM+7M8zCZtxGq+D3z o+ZaTSJ/fstG/QwuWnrELjXj/TwsSBMUMKO3nsUfgQt9OG9Yu71o99eVOrntwcLy6kHZ I4hfPKJnM/QiqEw4UnCFCp2xyOxH3b1C2jdYbpKwE99CmmnVPn4SBGz2MkueAfvcjfP0 TJKQ== X-Gm-Message-State: AOJu0Yy4y70wvPD+2PW5WHVU+Z3kq1oU1ZkJXQ1xWG09tbDInJqBKC2z PpVDtbu0w9acAhpGGai7XY9MEkypjNSJEIV4taItmIlJGz5yfWtRqIjmJO78w7thv3NIo/SP9+o LDjjmCPP+BPA+5BFz9OJ0WUD9xQ4xDLdy9zNU++rIUyxErww/3Ag0byawShM= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:1804:b0:497:da47:df4d with SMTP id 5614622812f47-4a47268dbc0mr8557504b6e.16.1784203762506; Thu, 16 Jul 2026 05:09:22 -0700 (PDT) Date: Thu, 16 Jul 2026 05:09:22 -0700 In-Reply-To: <6a588d44.c96faac9.59e0.0011.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a58c9f2.577457d1.8bd2.0021.GAE@google.com> Subject: Forwarded: [PATCH] usb: misc: uss720: fix memory leak by replacing usb_unlink_urb with usb_kill_urb From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] usb: misc: uss720: fix memory leak by replacing usb_unlink_urb with usb_kill_urb Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master kmemleak reported memory leaks in uss720_probe() during device initialization. The leaks occur because kill_all_async_requests_priv() was using usb_unlink_urb() which is asynchronous and returns immediately without waiting for the URB completion callbacks to finish. This caused a race condition where kref_put() in the probe_abort path would run before async_complete() had a chance to call destroy_async(), leaving the URB, request struct (uss720_async_request), and transfer buffer (dr) unreferenced and leaked. Fix this by replacing usb_unlink_urb() with usb_kill_urb() which blocks until the completion callback has finished, ensuring destroy_async() runs and frees all associated memory before kref_put() is called on priv. Since usb_kill_urb() may sleep, it cannot be called while holding a spinlock. Drop and reacquire the spinlock around each usb_kill_urb() call. Also switch to list_for_each_entry_safe() to safely handle list modification during iteration, as destroy_async() calls list_del_init() on the current entry. Reported-by: syzbot+56962eb32ba0136cd330@syzkaller.appspotmail.com Closes: http://syzkaller.appspot.com/bug?extid=56962eb32ba0136cd330 Signed-off-by: Deepanshu Kartikey --- drivers/usb/misc/uss720.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c index 1ce48f5832d7..f43fbb28044b 100644 --- a/drivers/usb/misc/uss720.c +++ b/drivers/usb/misc/uss720.c @@ -175,13 +175,15 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p static unsigned int kill_all_async_requests_priv(struct parport_uss720_private *priv) { - struct uss720_async_request *rq; + struct uss720_async_request *rq, *tmp; unsigned long flags; unsigned int ret = 0; spin_lock_irqsave(&priv->asynclock, flags); - list_for_each_entry(rq, &priv->asynclist, asynclist) { - usb_unlink_urb(rq->urb); + list_for_each_entry_safe(rq, tmp, &priv->asynclist, asynclist) { + spin_unlock_irqrestore(&priv->asynclock, flags); + usb_kill_urb(rq->urb); + spin_lock_irqsave(&priv->asynclock, flags); ret++; } spin_unlock_irqrestore(&priv->asynclock, flags); -- 2.43.0