[PATCH] ieee802154: atusb: Fix URB reference leak in atusb_work_urbs()

[PATCH] ieee802154: atusb: Fix URB reference leak in atusb_work_urbs()

[Wentao Liang]

usb_get_from_anchor() hands over a reference to the URB, which the caller
has to release. atusb_work_urbs() never does, so every URB collected from
the idle anchor keeps an extra reference: the reference count grows on
each retry cycle and the URBs are never freed on disconnect. Drop the
reference after a successful submission, and after the URB has been put
back on the idle anchor when submission failed, as the HCD holds its own
reference while the URB is in flight.

Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ieee802154/atusb.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 5f7fc4ee7a07..3dbb142eccb2 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -180,9 +180,15 @@ static void atusb_work_urbs(struct work_struct *work)
 		if (!urb)
 			return;
 		ret = atusb_submit_rx_urb(atusb, urb);
+		if (!ret)
+			usb_put_urb(urb);
 	} while (!ret);
 
+	/* The reference obtained above is dropped once the URB is back
+	 * on the idle anchor.
+	 */
 	usb_anchor_urb(urb, &atusb->idle_urbs);
+	usb_put_urb(urb);
 	dev_warn_ratelimited(&usb_dev->dev,
 			     "atusb_in: can't allocate/submit URB (%d)\n", ret);
 	schedule_delayed_work(&atusb->work,
-- 
2.34.1

Re: [PATCH] ieee802154: atusb: Fix URB reference leak in atusb_work_urbs()

[Miquel Raynal]

> usb_get_from_anchor() hands over a reference to the URB, which the caller
> has to release. atusb_work_urbs() never does, so every URB collected from
> the idle anchor keeps an extra reference: the reference count grows on
> each retry cycle and the URBs are never freed on disconnect. Drop the
> reference after a successful submission, and after the URB has been put
> back on the idle anchor when submission failed, as the HCD holds its own
> reference while the URB is in flight.
>
> Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Re: [PATCH] ieee802154: atusb: Fix URB reference leak in atusb_work_urbs()

[krzk]

On Thu, 17 Sep 2026 11:48:21 +0000, Wentao Liang wrote:
> usb_get_from_anchor() hands over a reference to the URB, which the caller
> has to release. atusb_work_urbs() never does, so every URB collected from
> the idle anchor keeps an extra reference: the reference count grows on
> each retry cycle and the URBs are never freed on disconnect. Drop the
> reference after a successful submission, and after the URB has been put
> back on the idle anchor when submission failed, as the HCD holds its own
> reference while the URB is in flight.
> 
> Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ieee802154/atusb.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof