Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

usb: misc: usbio: Fix URB memory leak on submit failure

When usb_submit_urb() fails in usbio_probe(), the previously allocated
URB is never freed, causing a memory leak.

Fix this by jumping to err_free_urb label to properly release the URB
on the error path.

Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Felix Gu and committed by
Greg Kroah-Hartman
33cfe070 8b7a42ec

+5 -2
+5 -2
drivers/usb/misc/usbio.c
··· 614 614 usb_fill_bulk_urb(usbio->urb, udev, usbio->rx_pipe, usbio->rxbuf, 615 615 usbio->rxbuf_len, usbio_bulk_recv, usbio); 616 616 ret = usb_submit_urb(usbio->urb, GFP_KERNEL); 617 - if (ret) 618 - return dev_err_probe(dev, ret, "Submitting usb urb\n"); 617 + if (ret) { 618 + dev_err_probe(dev, ret, "Submitting usb urb\n"); 619 + goto err_free_urb; 620 + } 619 621 620 622 mutex_lock(&usbio->ctrl_mutex); 621 623 ··· 665 663 err_unlock: 666 664 mutex_unlock(&usbio->ctrl_mutex); 667 665 usb_kill_urb(usbio->urb); 666 + err_free_urb: 668 667 usb_free_urb(usbio->urb); 669 668 670 669 return ret;