Re: [PATCH v2] usb: misc: usbio: Fix URB memory leak on submit failure

[Hans de Goede]

Hi,

On 31-Mar-26 14:05, Felix Gu wrote:
> When usb_submit_urb() fails in usbio_probe(), the previously allocated
> URB is never freed, causing a memory leak.
> 
> Fix this by jumping to err_free_urb label to properly release the URB
> on the error path.
> 
> Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> Signed-off-by: Felix Gu <ustc.gu@xxxxxxxxx>
> ---
> Changes in v2:
> - Fix Oliver's comment.
> - Link to v1: https://lore.kernel.org/lkml/20260330-usbio-v1-1-7141b6dc612a@xxxxxxxxx

Thanks, patch looks good to me:

Reviewed-by: Hans de Goede <johannes.goede@xxxxxxxxxxxxxxxx>

Regards,

Hans



> ---
>  drivers/usb/misc/usbio.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> index 2e68d48a2cc0..02d1e0760f0c 100644
> --- a/drivers/usb/misc/usbio.c
> +++ b/drivers/usb/misc/usbio.c
> @@ -614,8 +614,10 @@ static int usbio_probe(struct usb_interface *intf, const struct usb_device_id *i
>  	usb_fill_bulk_urb(usbio->urb, udev, usbio->rx_pipe, usbio->rxbuf,
>  			  usbio->rxbuf_len, usbio_bulk_recv, usbio);
>  	ret = usb_submit_urb(usbio->urb, GFP_KERNEL);
> -	if (ret)
> -		return dev_err_probe(dev, ret, "Submitting usb urb\n");
> +	if (ret) {
> +		dev_err_probe(dev, ret, "Submitting usb urb\n");
> +		goto err_free_urb;
> +	}
>  
>  	mutex_lock(&usbio->ctrl_mutex);
>  
> @@ -663,6 +665,7 @@ static int usbio_probe(struct usb_interface *intf, const struct usb_device_id *i
>  err_unlock:
>  	mutex_unlock(&usbio->ctrl_mutex);
>  	usb_kill_urb(usbio->urb);
> +err_free_urb:
>  	usb_free_urb(usbio->urb);
>  
>  	return ret;
> 
> ---
> base-commit: 3b058d1aeeeff27a7289529c4944291613b364e9
> change-id: 20260330-usbio-d70e15c97a7a
> 
> Best regards,