[PATCH] USB: sierra: Fix urb leak in sierra_submit_delayed_urbs()

[Wentao Liang]

sierra_submit_delayed_urbs() takes a reference to each delayed urb
with usb_get_from_anchor() before submitting it. The submit failure
path releases the reference with usb_free_urb(), but on the success
path the reference is never dropped: the urb is only anchored in the
active list and the USB core unanchors it on completion, leaving the
reference returned by usb_get_from_anchor() dangling so the urb
object is never freed.

Drop the reference with usb_put_urb() after a successful submission,
matching the reference handling in sierra_write() and the sierra_close()
drain loop. Skip the rest of the loop body with continue on the error
path, which already frees the urb.

Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while online")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/serial/sierra.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 6e443aacae07..c11259a8e66c 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -977,7 +977,9 @@ static int sierra_submit_delayed_urbs(struct usb_serial_port *port)
 			spin_lock(&portdata->lock);
 			portdata->outstanding_urbs--;
 			spin_unlock(&portdata->lock);
+			continue;
 		}
+		usb_put_urb(urb);
 	}
 
 	if (ec)
-- 
2.34.1