[PATCH] usb: usbtest: free the urb when unlink1() fails early

[PATCH] usb: usbtest: free the urb when unlink1() fails early

[Wentao Liang]

unlink1() allocates the urb and its transfer buffer with
simple_alloc_urb() and only frees them with simple_free_urb() after the
completion has been waited for.  Two error returns skip that cleanup and
leak both the urb and its coherent buffer, which also pins the device.

usb_submit_urb() never frees the urb it was given, so the failure return
has to free it.  The unexpected usb_unlink_urb() error return still
leaves the urb submitted, so kill it first to be sure the completion
callback has run before the urb and its buffer go away.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/misc/usbtest.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 8759df49be28..fb273516ee39 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -1459,6 +1459,7 @@ static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
 	retval = usb_submit_urb(urb, GFP_KERNEL);
 	if (retval != 0) {
 		dev_err(&dev->intf->dev, "submit fail %d\n", retval);
+		simple_free_urb(urb);
 		return retval;
 	}
 
@@ -1491,6 +1492,8 @@ static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
 			default:
 				dev_err(&dev->intf->dev,
 					"unlink fail %d\n", retval);
+				usb_kill_urb(urb);
+				simple_free_urb(urb);
 				return retval;
 			}
 
-- 
2.34.1

Re: [PATCH] usb: usbtest: free the urb when unlink1() fails early

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:15:32 +0000, Wentao Liang wrote:
> unlink1() allocates the urb and its transfer buffer with
> simple_alloc_urb() and only frees them with simple_free_urb() after the
> completion has been waited for.  Two error returns skip that cleanup and
> leak both the urb and its coherent buffer, which also pins the device.
> 
> usb_submit_urb() never frees the urb it was given, so the failure return
> has to free it.  The unexpected usb_unlink_urb() error return still
> leaves the urb submitted, so kill it first to be sure the completion
> callback has run before the urb and its buffer go away.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/misc/usbtest.c | 3 +++
>  1 file changed, 3 insertions(+)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] usb: usbtest: free the urb when unlink1() fails early

[sashiko-bot]

> unlink1() allocates the urb and its transfer buffer with
> simple_alloc_urb() and only frees them with simple_free_urb() after the
> completion has been waited for.  Two error returns skip that cleanup and
> leak both the urb and its coherent buffer, which also pins the device.
> 
> usb_submit_urb() never frees the urb it was given, so the failure return
> has to free it.  The unexpected usb_unlink_urb() error return still
> leaves the urb submitted, so kill it first to be sure the completion
> callback has run before the urb and its buffer go away.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104021532.1468741-1-vulab@iscas.ac.cn?part=1