* [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()
@ 2026-09-17 16:12 Wentao Liang
2026-09-18 6:48 ` Johan Hovold
0 siblings, 1 reply; 2+ messages in thread
From: Wentao Liang @ 2026-09-17 16:12 UTC (permalink / raw)
To: gregkh; +Cc: johan, linux-kernel, linux-usb, oneukum, Wentao Liang, stable
acm_resume() takes the delayed write urbs from the acm->delayed anchor
with usb_get_from_anchor(), which hands the reference held by the
anchor over to the caller. That reference is never released, so an urb
that was queued while the device was suspended is never freed.
Drop the reference after the urb has been resubmitted.
Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/usb/class/cdc-acm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 54059e4fc6ed..399c42b58cfc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
break;
acm_start_wb(acm, urb->context);
+ usb_free_urb(urb);
}
/*
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()
2026-09-17 16:12 [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume() Wentao Liang
@ 2026-09-18 6:48 ` Johan Hovold
0 siblings, 0 replies; 2+ messages in thread
From: Johan Hovold @ 2026-09-18 6:48 UTC (permalink / raw)
To: Wentao Liang; +Cc: gregkh, linux-kernel, linux-usb, oneukum, stable
On Thu, Sep 17, 2026 at 04:12:17PM +0000, Wentao Liang wrote:
> acm_resume() takes the delayed write urbs from the acm->delayed anchor
> with usb_get_from_anchor(), which hands the reference held by the
> anchor over to the caller. That reference is never released, so an urb
> that was queued while the device was suspended is never freed.
>
> Drop the reference after the urb has been resubmitted.
>
> Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/usb/class/cdc-acm.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
> index 54059e4fc6ed..399c42b58cfc 100644
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
> break;
>
> acm_start_wb(acm, urb->context);
> + usb_free_urb(urb);
Since this isn't dropping the reference taken at allocation I guess you
should be using usb_put_urb().
You should also fix the delayed urb handling in acm_port_shutdown()
added by the same commit.
And again, how was this found and fixed?
Johan
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-18 6:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-17 16:12 [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume() Wentao Liang
2026-09-18 6:48 ` Johan Hovold
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®