usb: misc: usbio: Fix URB memory leak on submit failure

When usb_submit_urb() fails in usbio_probe(), the previously allocated
URB is never freed, causing a memory leak.

Fix this by jumping to err_free_urb label to properly release the URB
on the error path.

Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
index 2e68d48a2cc075844c05c7b59c313ec86a7d8af0..02d1e0760f0c45cf1125afee88a54645154c9d46 100644 (file)
--- a/drivers/usb/misc/usbio.c
+++ b/drivers/usb/misc/usbio.c
@@ -614,8 +614,10 @@ static int usbio_probe(struct usb_interface *intf, const struct usb_device_id *i
        usb_fill_bulk_urb(usbio->urb, udev, usbio->rx_pipe, usbio->rxbuf,
                          usbio->rxbuf_len, usbio_bulk_recv, usbio);
        ret = usb_submit_urb(usbio->urb, GFP_KERNEL);
-       if (ret)
-               return dev_err_probe(dev, ret, "Submitting usb urb\n");
+       if (ret) {
+               dev_err_probe(dev, ret, "Submitting usb urb\n");
+               goto err_free_urb;
+       }
 
        mutex_lock(&usbio->ctrl_mutex);
 
@@ -663,6 +665,7 @@ static int usbio_probe(struct usb_interface *intf, const struct usb_device_id *i
 err_unlock:
        mutex_unlock(&usbio->ctrl_mutex);
        usb_kill_urb(usbio->urb);
+err_free_urb:
        usb_free_urb(usbio->urb);
 
        return ret;