[PATCH] USB: misc: uss720: fix refcount leak in submit_async_request()

[WenTao Liang]

When submit_async_request()'s call to usb_submit_urb() fails, the
error path directly calls destroy_async() on the request structure
instead of kref_put(). This bypasses the reference counting mechanism
because the kref is initialized to 1 and the preceding kref_get()
increments it to 2. The callback function async_complete() will never
run in this case, so the reference acquired by kref_get() is leaked,
and the structure is freed while still holding two references.

Fix by replacing destroy_async() with kref_put() in the failure
branch, properly releasing the extra reference.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: adaa3c6342b2 ("USB: uss720 fixup refcount position")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/misc/uss720.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index b7d3c44b970e..e1eba3cbef0a 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -168,7 +168,7 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
 	ret = usb_submit_urb(rq->urb, mem_flags);
 	if (!ret)
 		return rq;
-	destroy_async(&rq->ref_count);
+	kref_put(&rq->ref_count, destroy_async);
 	dev_err(&usbdev->dev, "submit_async_request submit_urb failed with %d\n", ret);
 	return NULL;
 }
-- 
2.50.1 (Apple Git-155)