Patchwork [3.5.y.z,extended,stable] Patch "net: usb: Fix memory leak on Tx data path" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Dec. 12, 2012, 5:11 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/205409/
State New
Headers show


Herton Ronaldo Krzesinski - Dec. 12, 2012, 5:11 a.m.
This is a note to let you know that I have just added a patch titled

    net: usb: Fix memory leak on Tx data path

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 834ffb23f3593ed395b8b915ea0f5f7c56620373 Mon Sep 17 00:00:00 2001
From: Hemant Kumar <>
Date: Thu, 25 Oct 2012 18:17:54 +0000
Subject: [PATCH] net: usb: Fix memory leak on Tx data path

commit 39707c2a3ba5011038b363f84d37c8a98d2d9db1 upstream.

Driver anchors the tx urbs and defers the urb submission if
a transmit request comes when the interface is suspended.
Anchoring urb increments the urb reference count. These
deferred urbs are later accessed by calling usb_get_from_anchor()
for submission during interface resume. usb_get_from_anchor()
unanchors the urb but urb reference count remains same.
This causes the urb reference count to remain non-zero
after usb_free_urb() gets called and urb never gets freed.
Hence call usb_put_urb() after anchoring the urb to properly
balance the reference count for these deferred urbs. Also,
unanchor these deferred urbs during disconnect, to free them

Signed-off-by: Hemant Kumar <>
Acked-by: Oliver Neukum <>
Signed-off-by: David S. Miller <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/net/usb/usbnet.c |    3 +++
 1 file changed, 3 insertions(+)



diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index f2716a4..a936201 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1161,6 +1161,7 @@  netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
 		usb_anchor_urb(urb, &dev->deferred);
 		/* no use to process more packets */
+		usb_put_urb(urb);
 		spin_unlock_irqrestore(&dev->txq.lock, flags);
 		netdev_dbg(dev->net, "Delaying transmission for resumption\n");
 		goto deferred;
@@ -1313,6 +1314,8 @@  void usbnet_disconnect (struct usb_interface *intf)


+	usb_scuttle_anchored_urbs(&dev->deferred);
 	if (dev->driver_info->unbind)
 		dev->driver_info->unbind (dev, intf);