From: Szymon Wilczek <[email protected]>
Date: 20 Dec 2025
Subject: [PATCH] media: pvrusb2: fix URB leak in pvr2_send_request_ex
Merged: 13 Jan 2026, by Hans Verkuil
When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb().
Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails.
signed, reported, fixes
- Reported-by syzbot reported it
- Signed-off-by Szymon Wilczek author
- Acked-by Mike Isely acked it
- Signed-off-by Hans Verkuil maintainer · merged it
diff
@@ -3709,6 +3709,11 @@ status); "Failed to submit read-control URB status=%d", status); hdw->ctl_read_pend_flag = 0;+ if (hdw->ctl_write_pend_flag) {+ usb_unlink_urb(hdw->ctl_write_urb);+ while (hdw->ctl_write_pend_flag)+ wait_for_completion(&hdw->ctl_done);+ } goto done; } }discussion · on the list
v1 · 2 messages
Szymon Wilczek author 20 Dec 2025
[PATCH] media: pvrusb2: fix URB leak in pvr2_send_request_ex
Mike Isely reviewer 20 Dec 2025