Re: [PATCH] USB: usb_wwan: Fix urb leak in usb_wwan_submit_delayed_urbs()

[Johan Hovold]

On Wed, Sep 16, 2026 at 04:58:46PM +0000, Wentao Liang wrote:
> usb_wwan_submit_delayed_urbs() takes a reference to each delayed urb
> with usb_get_from_anchor() before submitting it. The reference is
> never dropped, neither when the submission succeeds nor when it fails,
> so the submit-delayed urbs keep one reference forever and the urb
> objects are not freed when usb_wwan_port_remove() later drops the
> port's own reference. The urbs are not anchored in this path, so the
> USB core cannot drop a reference on completion either.
> 
> Drop the reference with usb_put_urb() on both the submission failure
> and the success path. The urb stays valid afterwards because the
> port's preallocated out_urbs array keeps its own reference, which
> matches how usb_wwan_write() submits the same urbs outside of
> suspend.
> 
> Fixes: 0d4561947b8d ("usb serial: Add generic USB wwan support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Also looks correct, but again, how was this issue found and fixed?

Johan