Patchwork [3.5.y.z,extended,stable] Patch "USB: XHCI: fix memory leak of URB-private data" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Feb. 12, 2013, 9:17 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/219955/
State New
Headers show


Herton Ronaldo Krzesinski - Feb. 12, 2013, 9:17 p.m.
This is a note to let you know that I have just added a patch titled

    USB: XHCI: fix memory leak of URB-private data

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 5c9bade3ced2661b3ad30a15cd658276352bdabd Mon Sep 17 00:00:00 2001
From: Alan Stern <>
Date: Thu, 17 Jan 2013 10:32:16 -0500
Subject: [PATCH] USB: XHCI: fix memory leak of URB-private data

commit 48c3375c5f69b1c2ef3d1051a0009cb9bce0ce24 upstream.

This patch (as1640) fixes a memory leak in xhci-hcd.  The urb_priv
data structure isn't always deallocated in the handle_tx_event()
routine for non-control transfers.  The patch adds a kfree() call so
that all paths end up freeing the memory properly.

This patch should be backported to kernels as old as 2.6.36, that
contain the commit 8e51adccd4c4b9ffcd509d7f2afce0a906139f75 "USB: xHCI:
Introduce urb_priv structure"

Signed-off-by: Alan Stern <>
Signed-off-by: Sarah Sharp <>
Reported-and-tested-by: Martin Mokrejs <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/usb/host/xhci-ring.c |    2 ++
 1 file changed, 2 insertions(+)



diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5530c76..6f3043f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2587,6 +2587,8 @@  cleanup:
 				(trb_comp_code != COMP_STALL &&
 					trb_comp_code != COMP_BABBLE))
 				xhci_urb_free_priv(xhci, urb_priv);
+			else
+				kfree(urb_priv);

 			usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
 			if ((urb->actual_length != urb->transfer_buffer_length &&