diff --git a/src/wps/wps_upnp.c b/src/wps/wps_upnp.c
index 53d797a8a..63a132896 100644
--- a/src/wps/wps_upnp.c
+++ b/src/wps/wps_upnp.c
@@ -734,13 +734,13 @@ static int subscription_first_event(struct subscription *s)
 
 
 /**
- * subscription_start - Rremember a UPnP control point to send events to.
+ * subscription_start - Remember a UPnP control point to send events to.
  * @sm: WPS UPnP state machine from upnp_wps_device_init()
- * @callback_urls: malloc' mem given to the subscription
+ * @callback_urls: Callback URLs
  * Returns: %NULL on error, or pointer to new subscription structure.
  */
 struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
-					 char *callback_urls)
+					 const char *callback_urls)
 {
 	struct subscription *s;
 	time_t now = time(NULL);
@@ -780,7 +780,6 @@ struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
 	}
 	wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription %p started with %s",
 		   s, callback_urls);
-	os_free(callback_urls);
 	/* Schedule sending this */
 	event_send_all_later(sm);
 	return s;
diff --git a/src/wps/wps_upnp_i.h b/src/wps/wps_upnp_i.h
index 63e6506d1..cfa30cffe 100644
--- a/src/wps/wps_upnp_i.h
+++ b/src/wps/wps_upnp_i.h
@@ -145,7 +145,7 @@ struct upnp_wps_device_sm {
 /* wps_upnp.c */
 void format_date(struct wpabuf *buf);
 struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
-					 char *callback_urls);
+					 const char *callback_urls);
 struct subscription * subscription_renew(struct upnp_wps_device_sm *sm,
 					 const u8 uuid[UUID_LEN]);
 void subscription_unlink(struct subscription *s);
diff --git a/src/wps/wps_upnp_web.c b/src/wps/wps_upnp_web.c
index 4332ea3c7..abdcf15ff 100644
--- a/src/wps/wps_upnp_web.c
+++ b/src/wps/wps_upnp_web.c
@@ -925,7 +925,6 @@ static void web_connection_parse_subscribe(struct upnp_wps_device_sm *sm,
 			ret = HTTP_INTERNAL_SERVER_ERROR;
 			goto error;
 		}
-		callback_urls = NULL;   /* is now owned by subscription */
 	} else {
 		ret = HTTP_PRECONDITION_FAILED;
 		goto error;
@@ -975,6 +974,7 @@ error:
 	*/
 	http_put_empty(buf, ret);
 	http_request_send_and_deinit(req, buf);
+	os_free(callback_urls);
 }