[PATCH] ieee802154: atusb: drop the URB reference after a failed resubmit

[Wentao Liang <vulab@iscas.ac.cn>]

usb_get_from_anchor() returns the URB with a reference held by the
caller.  When atusb_submit_rx_urb() fails, that reference is not consumed,
and re-anchoring the URB takes an additional one.  The caller's reference
is then never dropped.

Release it after putting the URB back on the idle anchor.

Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ieee802154/atusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 5f7fc4ee7a07..c924f17171f4 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -183,6 +183,7 @@ static void atusb_work_urbs(struct work_struct *work)
 	} while (!ret);
 
 	usb_anchor_urb(urb, &atusb->idle_urbs);
+	usb_free_urb(urb);
 	dev_warn_ratelimited(&usb_dev->dev,
 			     "atusb_in: can't allocate/submit URB (%d)\n", ret);
 	schedule_delayed_work(&atusb->work,
-- 
2.34.1