Re: [PATCH] fix: drivers/usb/serial: garmin_write_bulk: urb freed prematurely on success path

[Johan Hovold]

On Sat, Jun 27, 2026 at 11:37:48AM +0800, WenTao Liang wrote:
> In garmin_write_bulk(), usb_free_urb(urb) is called unconditionally after
> URB submission, even on the success path. When the URB completes later,
> the completion callback may perform additional operations on the
> already-freed URB structure, causing use-after-free or double free.
> 
> Move usb_free_urb(urb) to the error path only, allowing the completion
> callback to properly manage the URB lifecycle on success.

No, this patch is also broken. USB core holds a reference to the URB
until the completion has been called.

> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: c4ac4496e835 ("USB: serial: garmin_gps: fix memory leak on failed URB submit")

This commit has nothing to do with this.

> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>

Johan