From nobody Thu Dec 18 23:23:17 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EB3A3587A1 for ; Tue, 16 Dec 2025 15:14:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765898061; cv=none; b=TBF+y0f+N4WNWzJkkHmBkOuaORNb4hO6nxptU2kxTtjXr4j12aPEXtWxO0ai+EuIgDG0i9iuj/VwENbIyhbDbo8OuV8ewjc1JiPPgk8wx80pmkK5LzzdieVAW37KyuN+wgRpDKeCzAqUBmQVXHB+iO/y/7KCNIY4oCnzo8rSuCs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765898061; c=relaxed/simple; bh=l3aFcFIb/rETTTHoywtwScOBMd14d3C/McfXoy+MH7g=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=J9+dolk1hU6TmUy1iHA0bXP67pSTu3QdohQGn0Klr2s2Zo6zuqkoYmYelqhZ4xCM0TCtD99cl1fGz+NKaCHZFxOdMS0+FL7qi96bj2cSIZ02d4e9iRELSy3prDvCYyNWb/KZFh2+rxBLI+H9qZ2xe6pI2JdItQKXbxcoIuqeG10= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=N0HoOtUu; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=O2Rp3LTE; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="N0HoOtUu"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="O2Rp3LTE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1765898058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=KGroo1FRQJLcCV21iN/HVdCn1Y2Qr7NjzdMpGVOhIKQ=; b=N0HoOtUub25DTpiiJRvjLrVyzKLKLVBUS2+y7XlrF6gISSkQvhi1khjt25Ql1MespKY4qp OmUQr9yjv/sY4G2EoT7JR5sHmcEOrBpH8Hrj5zYZKkVtYPcl7GpsJMz0GUZv4e06I30vWo CGjLRCwo0hgmKrHdUVAzXM69QHjcHr0= Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-257-d408ZCb9Nb-LajxOZS-92A-1; Tue, 16 Dec 2025 10:14:16 -0500 X-MC-Unique: d408ZCb9Nb-LajxOZS-92A-1 X-Mimecast-MFC-AGG-ID: d408ZCb9Nb-LajxOZS-92A_1765898054 Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-29da1ea0b97so120293685ad.3 for ; Tue, 16 Dec 2025 07:14:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1765898054; x=1766502854; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=KGroo1FRQJLcCV21iN/HVdCn1Y2Qr7NjzdMpGVOhIKQ=; b=O2Rp3LTEPAPHfbrnLQhN/g4LZBnNRN/U/p1rPmAb4+C+7HuX5CbY9P4LsbxtY1LrN9 h5nHwT17bgW0pQbhmd0lZE/l9ZZSGtqLFduV8pOpReyFegvHW1cGmFf/euuyTmIXc9Ow ++wWt1yqoywvVzDf4QAGY+DoFFXudpJRcKzC+XHJPlnEVs/4h3FLL0tktoTYmtOpPelf LeLST5uf4L02LKFkg9fNkvaeZvirQoOF35MGTQ+ZwVojGQAF68cdSLcKKfsVDNmgp+JO Ky9yICpi3zlrRV/PbtgkCQlPTN3eY70mrKGr/iWB2sgbhanVxbMYORfkEkmfMrG1/3Ri SlRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765898054; x=1766502854; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=KGroo1FRQJLcCV21iN/HVdCn1Y2Qr7NjzdMpGVOhIKQ=; b=ornyM+f+zuTgKTQLysMXuiwwffYFV9VFAJXDICaux+I44xLiu5TzzcEx5PTR1FHewi NQNDR/U+AOv96kAP21G1hvG8t6NA/EGNuK0jDCgpMjXcYaGTsH1wbx+tMOu/rO27XrVq 6fuDGaceOVyqfu7yKWMw8Klt3FGV9oOXyZaYSJCgCckHJDBcFAUbw3FvBDY0F0HDYzgg B015cVxDqUdZWpITk1JnmgXiFW5fQJS8w1BVYhLa3ywhv4LS3XHbQRoeBeTuZSEjueW9 rNOHBJ3sZ3JEbODszHicc5Sm9sK7VqGkwxqqBQUq2ya9xppL37LE7TqbKLb2z+Sm9Xxl ARlw== X-Forwarded-Encrypted: i=1; AJvYcCW4iig1jvIoMhoBUsEWBjHjT1+I8VADn/AdAi6HL8h5vwgwuGwLRaXdmv6ORupj/tOsIAiNPWnL7Ti46Ww=@vger.kernel.org X-Gm-Message-State: AOJu0YzLYgAkAzjyDDHX8zlNb8w0S2vX1j3zwB+yqLfmRsnFOE6YP+i7 DVA4O3kcUVzp17BPpwMJRjJRBUG6F1+xZXoUAO4va4nscu2ZJcnrkfZ71XoQ+mB4mIRBd4SE1mJ FxgRHHL2awitPimJbmt7TF8iPyuPkOwHFHYvTincaVBHrG4jXF2WYj1rUHaFa4g2b X-Gm-Gg: AY/fxX7au4pPhBmKPvMYwGA/TtW8NFwFYYWdnf0hq9gAeAduPJfzioySMaj9nW+CeAW cfa5HWrrT6G3j2ESwZ7S5QCU+tK7CJ5/IW1brTQJ905c0kujWLTBAkxF6R2tZBGyDj+9z+FUgd/ pCeZNzZMj7qEShF8LdS6tIQ/zifFFi4Mz0lrS/2tu2QNxYexrsWR5AoTGiQn8p28pjA9mrCSU4h /f6j2s4cSty8Al/FEiNLgIsndWc5DEW8Nd3+eQsKO/GCIpfQq0Ec9KxBFZPVWZbAoV8dnfRrmc9 pdALPTokzlndRtOgroDP15rAf6WTwkUaLXikd143KgsfdOamUfY7wUprw3cyiLj9e7arlS9jw/D 2dBtEsJDwfqZflH2Vgjv6yN6tDIHUPfVbnGpJyw== X-Received: by 2002:a17:902:e947:b0:2a0:f488:24e with SMTP id d9443c01a7336-2a0f488039cmr72598995ad.28.1765898054348; Tue, 16 Dec 2025 07:14:14 -0800 (PST) X-Google-Smtp-Source: AGHT+IHreRegPQkGmWbCVch5XFt0fM9KZJ4HiBSvqPfGMq3/Z86mPrICGllWYxJgnaXN7I+HROG0mA== X-Received: by 2002:a17:902:e947:b0:2a0:f488:24e with SMTP id d9443c01a7336-2a0f488039cmr72598365ad.28.1765898053897; Tue, 16 Dec 2025 07:14:13 -0800 (PST) Received: from dkarn-thinkpadp16vgen1.punetw6.csb ([2402:e280:3e0d:a45:3861:8b7f:6ae1:6229]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29f177ff327sm137688045ad.101.2025.12.16.07.14.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Dec 2025 07:14:13 -0800 (PST) From: Deepakkumar Karn To: petkan@nucleusys.com, netdev@vger.kernel.org Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+8dd915c7cb0490fc8c52@syzkaller.appspotmail.com, Deepakkumar Karn Subject: [PATCH] net: usb: rtl8150: fix memory leak on usb_submit_urb() failure Date: Tue, 16 Dec 2025 20:43:05 +0530 Message-ID: <20251216151304.59865-2-dkarn@redhat.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails. Reported-by: syzbot+8dd915c7cb0490fc8c52@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D8dd915c7cb0490fc8c52 Fixes: 4d12997a9bb3 ("drivers: net: usb: rtl8150: concurrent URB bugfix") Signed-off-by: Deepakkumar Karn --- drivers/net/usb/rtl8150.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index 278e6cb6f4d9..e40b0669d9f4 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -211,6 +211,8 @@ static int async_set_registers(rtl8150_t *dev, u16 indx= , u16 size, u16 reg) if (res =3D=3D -ENODEV) netif_device_detach(dev->netdev); dev_err(&dev->udev->dev, "%s failed with %d\n", __func__, res); + kfree(req); + usb_free_urb(async_urb); } return res; } --=20 2.52.0