Re: [PATCH] USB: misc: uss720: fix refcount leak in submit_async_request()

[Greg KH]

On Thu, Jun 11, 2026 at 09:29:52PM +0800, WenTao Liang wrote:
> When submit_async_request()'s call to usb_submit_urb() fails, the
> error path directly calls destroy_async() on the request structure
> instead of kref_put(). This bypasses the reference counting mechanism
> because the kref is initialized to 1 and the preceding kref_get()
> increments it to 2. The callback function async_complete() will never
> run in this case, so the reference acquired by kref_get() is leaked,
> and the structure is freed while still holding two references.
> 
> Fix by replacing destroy_async() with kref_put() in the failure
> branch, properly releasing the extra reference.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: adaa3c6342b2 ("USB: uss720 fixup refcount position")
> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/usb/misc/uss720.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
> index b7d3c44b970e..e1eba3cbef0a 100644
> --- a/drivers/usb/misc/uss720.c
> +++ b/drivers/usb/misc/uss720.c
> @@ -168,7 +168,7 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
>  	ret = usb_submit_urb(rq->urb, mem_flags);
>  	if (!ret)
>  		return rq;
> -	destroy_async(&rq->ref_count);
> +	kref_put(&rq->ref_count, destroy_async);

As
https://sashiko.dev/#/patchset/20260611132952.83931-1-vulab@xxxxxxxxxxx
shows, this creates a new bug :(