From: Wentao Liang <vulab@iscas.ac.cn>
To: gregkh@linuxfoundation.org
Cc: johan@kernel.org, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, oneukum@suse.com,
Wentao Liang <vulab@iscas.ac.cn>,
stable@vger.kernel.org
Subject: [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()
Date: Thu, 17 Sep 2026 16:12:17 +0000 [thread overview]
Message-ID: <20260917161217.2161883-1-vulab@iscas.ac.cn> (raw)
acm_resume() takes the delayed write urbs from the acm->delayed anchor
with usb_get_from_anchor(), which hands the reference held by the
anchor over to the caller. That reference is never released, so an urb
that was queued while the device was suspended is never freed.
Drop the reference after the urb has been resubmitted.
Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/usb/class/cdc-acm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 54059e4fc6ed..399c42b58cfc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
break;
acm_start_wb(acm, urb->context);
+ usb_free_urb(urb);
}
/*
--
2.34.1
next reply other threads:[~2026-09-17 16:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-17 16:12 Wentao Liang [this message]
2026-09-18 6:48 ` [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume() Johan Hovold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260917161217.2161883-1-vulab@iscas.ac.cn \
--to=vulab@iscas.ac.cn \
--cc=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox