> usb_get_from_anchor() hands over a reference to the URB, which the caller
> has to release. atusb_work_urbs() never does, so every URB collected from
> the idle anchor keeps an extra reference: the reference count grows on
> each retry cycle and the URBs are never freed on disconnect. Drop the
> reference after a successful submission, and after the URB has been put
> back on the idle anchor when submission failed, as the HCD holds its own
> reference while the URB is in flight.
>
> Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
> Cc: [email protected]
> Signed-off-by: Wentao Liang <[email protected]>Reviewed-by: Miquel Raynal <[email protected]>
