usb9pfs->out_req is allocated with alloc_ep_req(), which also allocates the request's data buffer (req->buf). disable_usb9pfs() frees it with plain usb_ep_free_request(), which only frees the usb_request structure itself and leaks req->buf on every close. Use free_ep_req() instead, matching the allocator, as documented by its own comment ("Requests allocated via alloc_ep_req() *must* be freed by free_ep_req()"). Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Michael Grzeschik --- net/9p/trans_usbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c index af113746d2fc..9bcad638d827 100644 --- a/net/9p/trans_usbg.c +++ b/net/9p/trans_usbg.c @@ -284,7 +284,7 @@ static void disable_usb9pfs(struct f_usb9pfs *usb9pfs) } if (usb9pfs->out_req) { - usb_ep_free_request(usb9pfs->out_ep, usb9pfs->out_req); + free_ep_req(usb9pfs->out_ep, usb9pfs->out_req); usb9pfs->out_req = NULL; } -- 2.53.0