Commit 33cfe070 authored Mar 31, 2026 by Felix Gu Committed by Greg Kroah-Hartman Apr 02, 2026

usb: misc: usbio: Fix URB memory leak on submit failure



When usb_submit_urb() fails in usbio_probe(), the previously allocated
URB is never freed, causing a memory leak.

Fix this by jumping to err_free_urb label to properly release the URB
on the error path.

Fixes: 121a0f83 ("usb: misc: Add Intel USBIO bridge driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 8b7a42ec

drivers/usb/misc/usbio.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -614,8 +614,10 @@ static int usbio_probe(struct usb_interface intf, const struct usb_device_id i
		usb_fill_bulk_urb(usbio->urb, udev, usbio->rx_pipe, usbio->rxbuf,
		usbio->rxbuf_len, usbio_bulk_recv, usbio);
		ret = usb_submit_urb(usbio->urb, GFP_KERNEL);
		if (ret)
		return dev_err_probe(dev, ret, "Submitting usb urb\n");
		if (ret) {
		dev_err_probe(dev, ret, "Submitting usb urb\n");
		goto err_free_urb;
		}

		mutex_lock(&usbio->ctrl_mutex);

		@@ -663,6 +665,7 @@ static int usbio_probe(struct usb_interface intf, const struct usb_device_id i
		err_unlock:
		mutex_unlock(&usbio->ctrl_mutex);
		usb_kill_urb(usbio->urb);
		err_free_urb:
		usb_free_urb(usbio->urb);

		return ret;