[PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[Wentao Liang]

acm_resume() takes the delayed write urbs from the acm->delayed anchor
with usb_get_from_anchor(), which hands the reference held by the
anchor over to the caller. That reference is never released, so an urb
that was queued while the device was suspended is never freed.

Drop the reference after the urb has been resubmitted.

Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/class/cdc-acm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 54059e4fc6ed..399c42b58cfc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
 				break;
 
 			acm_start_wb(acm, urb->context);
+			usb_free_urb(urb);
 		}
 
 		/*
-- 
2.34.1

Re: [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[Johan Hovold]

On Thu, Sep 17, 2026 at 04:12:17PM +0000, Wentao Liang wrote:
> acm_resume() takes the delayed write urbs from the acm->delayed anchor
> with usb_get_from_anchor(), which hands the reference held by the
> anchor over to the caller. That reference is never released, so an urb
> that was queued while the device was suspended is never freed.
> 
> Drop the reference after the urb has been resubmitted.
> 
> Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/class/cdc-acm.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
> index 54059e4fc6ed..399c42b58cfc 100644
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
>  				break;
>  
>  			acm_start_wb(acm, urb->context);
> +			usb_free_urb(urb);

Since this isn't dropping the reference taken at allocation I guess you
should be using usb_put_urb().

You should also fix the delayed urb handling in acm_port_shutdown()
added by the same commit.

And again, how was this found and fixed?

Johan