[lkml]   [2018]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.18 33/44] usb: cdc_acm: Do not leak URB buffers
4.18-stable review patch.  If anyone has any objections, please let me know.


From: Romain Izard <>

commit f2924d4b16ae138c2de6a0e73f526fb638330858 upstream.

When the ACM TTY port is disconnected, the URBs it uses must be killed, and
then the buffers must be freed. Unfortunately a previous refactor removed
the code freeing the buffers because it looked extremely similar to the
code killing the URBs.

As a result, there were many new leaks for each plug/unplug cycle of a
CDC-ACM device, that were detected by kmemleak.

Restore the missing code, and the memory leak is removed.

Fixes: ba8c931ded8d ("cdc-acm: refactor killing urbs")
Signed-off-by: Romain Izard <>
Acked-by: Oliver Neukum <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/usb/class/cdc-acm.c | 6 ++++++
1 file changed, 6 insertions(+)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1514,6 +1514,7 @@ static void acm_disconnect(struct usb_in
struct acm *acm = usb_get_intfdata(intf);
struct tty_struct *tty;
+ int i;

/* sibling interface is already cleaning up */
if (!acm)
@@ -1544,6 +1545,11 @@ static void acm_disconnect(struct usb_in

tty_unregister_device(acm_tty_driver, acm->minor);

+ usb_free_urb(acm->ctrlurb);
+ for (i = 0; i < ACM_NW; i++)
+ usb_free_urb(acm->wb[i].urb);
+ for (i = 0; i < acm->rx_buflimit; i++)
+ usb_free_urb(acm->read_urbs[i]);
usb_free_coherent(acm->dev, acm->ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);

 \ /
  Last update: 2018-10-11 17:50    [W:0.178 / U:13.960 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site