usb_get_from_anchor() returns the URB with a reference held by the caller. When atusb_submit_rx_urb() fails, that reference is not consumed, and re-anchoring the URB takes an additional one. The caller's reference is then never dropped. Release it after putting the URB back on the idle anchor. Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/net/ieee802154/atusb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c index 5f7fc4ee7a07..c924f17171f4 100644 --- a/drivers/net/ieee802154/atusb.c +++ b/drivers/net/ieee802154/atusb.c @@ -183,6 +183,7 @@ static void atusb_work_urbs(struct work_struct *work) } while (!ret); usb_anchor_urb(urb, &atusb->idle_urbs); + usb_free_urb(urb); dev_warn_ratelimited(&usb_dev->dev, "atusb_in: can't allocate/submit URB (%d)\n", ret); schedule_delayed_work(&atusb->work, -- 2.34.1