[PATCH] usb: misc: fix refcount leak in get_1284_register()

[WenTao Liang]

In get_1284_register(), submit_async_request() returns an
"rq" object with a caller's reference. If the subsequent
wait_for_completion_timeout() times out, the error path
calls kill_all_async_requests_priv() to cancel pending
URBs, but it fails to drop that caller's reference. All
other paths (early exit on !val and the successful
completion path) correctly call kref_put() to release the
reference. This leak results in the memory allocated for
the request never being freed.

Fix the timeout path by adding the missing kref_put() call
before returning -EIO.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 0f36163d3abe ("[PATCH] usb: fix uss720 schedule with interrupts off")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/misc/uss720.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index e1eba3cbef0a..ca97d77cfe2e 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -223,6 +223,7 @@ static int get_1284_register(struct parport *pp, unsigned char reg, unsigned cha
 	}
 	printk(KERN_WARNING "get_1284_register timeout\n");
 	kill_all_async_requests_priv(priv);
+	kref_put(&rq->ref_count, destroy_async);
 	return -EIO;
 }
 
-- 
2.50.1 (Apple Git-155)