Re: [PATCH] usb: cdc-acm: Fix urb reference leak in acm_resume()

[Johan Hovold]

On Thu, Sep 17, 2026 at 04:12:17PM +0000, Wentao Liang wrote:
> acm_resume() takes the delayed write urbs from the acm->delayed anchor
> with usb_get_from_anchor(), which hands the reference held by the
> anchor over to the caller. That reference is never released, so an urb
> that was queued while the device was suspended is never freed.
> 
> Drop the reference after the urb has been resubmitted.
> 
> Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/usb/class/cdc-acm.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
> index 54059e4fc6ed..399c42b58cfc 100644
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -1703,6 +1703,7 @@ static int acm_resume(struct usb_interface *intf)
>  				break;
>  
>  			acm_start_wb(acm, urb->context);
> +			usb_free_urb(urb);

Since this isn't dropping the reference taken at allocation I guess you
should be using usb_put_urb().

You should also fix the delayed urb handling in acm_port_shutdown()
added by the same commit.

And again, how was this found and fixed?

Johan