[PATCH] net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()

[PATCH] net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()

[Wentao Liang]

usb_get_from_anchor() hands over a reference to the URB, which the caller
must release. lan78xx_submit_deferred_urbs() never does, so every deferred
Tx URB keeps an extra reference: the counter grows on each suspend/resume
cycle and the URBs are never freed when the buffers are released. Drop
the reference after submitting, and on the path that drops the packet
instead of submitting it.

Fixes: 5f4cc6e25148 ("lan78xx: Fix race conditions in suspend/resume handling")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/usb/lan78xx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index bcf293ea1bd3..8e075a31d97c 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -5204,10 +5204,12 @@ static bool lan78xx_submit_deferred_urbs(struct lan78xx_net *dev)
 		    !netif_carrier_ok(dev->net) ||
 		    pipe_halted) {
 			lan78xx_release_tx_buf(dev, skb);
+			usb_put_urb(urb);
 			continue;
 		}
 
 		ret = usb_submit_urb(urb, GFP_ATOMIC);
+		usb_put_urb(urb);
 
 		if (ret == 0) {
 			netif_trans_update(dev->net);
-- 
2.34.1

Re: [PATCH] net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu, 17 Sep 2026 11:58:11 +0000 you wrote:
> usb_get_from_anchor() hands over a reference to the URB, which the caller
> must release. lan78xx_submit_deferred_urbs() never does, so every deferred
> Tx URB keeps an extra reference: the counter grows on each suspend/resume
> cycle and the URBs are never freed when the buffers are released. Drop
> the reference after submitting, and on the path that drops the packet
> instead of submitting it.
> 
> [...]

Here is the summary with links:
  - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
    https://git.kernel.org/netdev/net/c/17741334d00b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html