[PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[Wentao Liang]

acm_resume() takes the delayed write urbs from the acm->delayed anchor
with usb_get_from_anchor(), which hands the reference held by the
anchor over to the caller. That reference is never released, so an urb
that was queued while the device was suspended is never freed.

Drop the reference after the urb has been resubmitted.

Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/class/cdc-acm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 54059e4fc6ed..399c42b58cfc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
 				break;
 
 			acm_start_wb(acm, urb->context);
+			usb_free_urb(urb);
 		}
 
 		/*
-- 
2.34.1

Re: [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[Johan Hovold]

On Thu, Sep 17, 2026 at 04:12:17PM +0000, Wentao Liang wrote:
> acm_resume() takes the delayed write urbs from the acm->delayed anchor
> with usb_get_from_anchor(), which hands the reference held by the
> anchor over to the caller. That reference is never released, so an urb
> that was queued while the device was suspended is never freed.
> 
> Drop the reference after the urb has been resubmitted.
> 
> Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/class/cdc-acm.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
> index 54059e4fc6ed..399c42b58cfc 100644
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
>  				break;
>  
>  			acm_start_wb(acm, urb->context);
> +			usb_free_urb(urb);

Since this isn't dropping the reference taken at allocation I guess you
should be using usb_put_urb().

You should also fix the delayed urb handling in acm_port_shutdown()
added by the same commit.

And again, how was this found and fixed?

Johan

Re: [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[Wentao Liang]

Hi Johan,

Sorry for the very late reply, and for the extra work. Thank you for the
review. Both points are right: the reference from usb_get_from_anchor()
should be dropped as a put, and acm_port_shutdown() needed the same fix. I
see you took care of both in 648b08aa37c1 ("USB: cdc-acm: fix urb leak on
disconnect"); it is in mainline and has already been queued for stable, so I
am not resending anything and patchwork 14825884 can be dropped.

On how this was found and fixed: I have described it once, in my reply to the
sierra patch, rather than repeating the same explanation in every thread.

I am working through the outstanding feedback by hand now and will not send
patches in bulk again.

Thanks,
Wentao