[PATCH] USB: usb_wwan: Fix urb leak in usb_wwan_submit_delayed_urbs()

[Wentao Liang]

usb_wwan_submit_delayed_urbs() takes a reference to each delayed urb
with usb_get_from_anchor() before submitting it. The reference is
never dropped, neither when the submission succeeds nor when it fails,
so the submit-delayed urbs keep one reference forever and the urb
objects are not freed when usb_wwan_port_remove() later drops the
port's own reference. The urbs are not anchored in this path, so the
USB core cannot drop a reference on completion either.

Drop the reference with usb_put_urb() on both the submission failure
and the success path. The urb stays valid afterwards because the
port's preallocated out_urbs array keeps its own reference, which
matches how usb_wwan_write() submits the same urbs outside of
suspend.

Fixes: 0d4561947b8d ("usb serial: Add generic USB wwan support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/serial/usb_wwan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 2c46330f10da..e7566960a5c1 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -587,9 +587,11 @@ static int usb_wwan_submit_delayed_urbs(struct usb_serial_port *port)
 			err_count++;
 			unbusy_queued_urb(urb, portdata);
 			usb_autopm_put_interface_async(serial->interface);
+			usb_put_urb(urb);
 			continue;
 		}
 		data->in_flight++;
+		usb_put_urb(urb);
 	}
 
 	if (err_count)
-- 
2.34.1