[PATCH] USB: usb_wwan: Fix urb leak in usb_wwan_submit_delayed_urbs()

[PATCH] USB: usb_wwan: Fix urb leak in usb_wwan_submit_delayed_urbs()

[Wentao Liang]

usb_wwan_submit_delayed_urbs() takes a reference to each delayed urb
with usb_get_from_anchor() before submitting it. The reference is
never dropped, neither when the submission succeeds nor when it fails,
so the submit-delayed urbs keep one reference forever and the urb
objects are not freed when usb_wwan_port_remove() later drops the
port's own reference. The urbs are not anchored in this path, so the
USB core cannot drop a reference on completion either.

Drop the reference with usb_put_urb() on both the submission failure
and the success path. The urb stays valid afterwards because the
port's preallocated out_urbs array keeps its own reference, which
matches how usb_wwan_write() submits the same urbs outside of
suspend.

Fixes: 0d4561947b8d ("usb serial: Add generic USB wwan support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/serial/usb_wwan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 2c46330f10da..e7566960a5c1 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -587,9 +587,11 @@ static int usb_wwan_submit_delayed_urbs(struct usb_serial_port *port)
 			err_count++;
 			unbusy_queued_urb(urb, portdata);
 			usb_autopm_put_interface_async(serial->interface);
+			usb_put_urb(urb);
 			continue;
 		}
 		data->in_flight++;
+		usb_put_urb(urb);
 	}
 
 	if (err_count)
-- 
2.34.1

Re: [PATCH] USB: usb_wwan: Fix urb leak in usb_wwan_submit_delayed_urbs()

[Johan Hovold]

On Wed, Sep 16, 2026 at 04:58:46PM +0000, Wentao Liang wrote:
> usb_wwan_submit_delayed_urbs() takes a reference to each delayed urb
> with usb_get_from_anchor() before submitting it. The reference is
> never dropped, neither when the submission succeeds nor when it fails,
> so the submit-delayed urbs keep one reference forever and the urb
> objects are not freed when usb_wwan_port_remove() later drops the
> port's own reference. The urbs are not anchored in this path, so the
> USB core cannot drop a reference on completion either.
> 
> Drop the reference with usb_put_urb() on both the submission failure
> and the success path. The urb stays valid afterwards because the
> port's preallocated out_urbs array keeps its own reference, which
> matches how usb_wwan_write() submits the same urbs outside of
> suspend.
> 
> Fixes: 0d4561947b8d ("usb serial: Add generic USB wwan support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Also looks correct, but again, how was this issue found and fixed?

Johan