From nobody Sun Feb 8 11:59:27 2026 Received: from mail-ej1-f49.google.com (mail-ej1-f49.google.com [209.85.218.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F88F32C939 for ; Mon, 22 Dec 2025 15:42:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766418147; cv=none; b=UKv4KCi+dKI2IWlbWp1titntdtvCx9RSSIPHWjdmowQahWWXeczgBH5D2/ClsQ3emDxYZ7Cp8fpTwy+GkbkaKcSWMfCU4uAXojvofGA6BJd0tqb2fijjYW1pCMesJf94rsc6FGgIvnKSlGZxROklyGpF1b+BzkCPSvFI+n08m6o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766418147; c=relaxed/simple; bh=PK54Vy1SNWF2cozJivqVKZzpFOSBZDESHiOGhjh4Uiw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lzVBnWs6TLQh7f9CDwitMG5fkAGfq5clK7j2GMiCrubGnux4FU2HhLhscnV0mUR44nMwjLIzgT2SMvIJh6iNPGkQCBSNZO/+8hHNwiGiY/uagCu2YbAsawY6L7/41GUQ/AH714o4uHlrnWD28ADmKWVBgaXEd9uhpGY16Fe3wHk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ctNIdn9Q; arc=none smtp.client-ip=209.85.218.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ctNIdn9Q" Received: by mail-ej1-f49.google.com with SMTP id a640c23a62f3a-b7a6e56193cso686034266b.3 for ; Mon, 22 Dec 2025 07:42:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766418144; x=1767022944; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=mblUD38NHDbav+TAFmjVgjtSnMMRCCdvFD/wMYmq7jU=; b=ctNIdn9Qir2RMzR4Ggh0T6zv5NgFuPF4UyUqN386jMixsVrrQVE+u2a5Jk6p2fCMMN Z9KKb6YzcMOv7ALZ8G6Uy5yvreAAzCAcUV+9EWAVQJSfH3f/90Kvcr1we//k7p2uhAFy UOqgLOf07RNUI7bW7WegWPU+YSIK9xKYIOvERqtQ0kSMpv2G1JWctuqnUEf/yvhorDHb TGJDi4qJ1CfI3H1WjjFUDsHp2LLTE5pWR4J392m5SSvB1q89biWVthpKiH0VCXLKLvvh uFwrK+MCC4rSaFQke67xR9FExZyM4b7gRozfZurdWAo7I57PsIRtS59HRVc9kxW032N7 4Fog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766418144; x=1767022944; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=mblUD38NHDbav+TAFmjVgjtSnMMRCCdvFD/wMYmq7jU=; b=RA37t4WQ+YWk+bVLhGHKMuQPV2OUkaVrfoJha6B1u+ebtsbDARKhPFGlODJr6DlTP6 8oN3ygNyA8KYPT3dkgZi0F8Tl1/qzXUlx77cufnS6i7sCyebKbum04rcxx7kC2hKb5J8 be/Dd+wHoZ4LtLMBZkXYrvDwNKfMC6SQUhRiTthir5bpbEq/riNGZbG7YmcoJpltyj80 RzEq+tVu/OjE1EK9xl53Y1srP6cb8mVrCRf45dAlx4hbGtjbGtTfOi37rQUL5tKUqicg +cXvnRvaL3LM8wkOVQY/AVbvGWRfkeoqKJWlot1ESFivS0EWBO4nnMCRiOsZN3wiOxqu TM0A== X-Forwarded-Encrypted: i=1; AJvYcCXdpqzyLs8EjDggrsD+O4txwoFkdWR2CPgCRdOXTxiuphaRPLdTm8PJ00xaktEt9OrM97sfE85NuaxI1Xc=@vger.kernel.org X-Gm-Message-State: AOJu0YxDuRy/W21qIreVo3KmdJWjbzcOfmlqcKqqBpO4HOrz5METAnJR 9khmdWPkROYOVqISljqpkC4uA6knPAdRNWibaYOsKQCCCqnB9BC2mwLr X-Gm-Gg: AY/fxX64TQhbRv6b+GQEOqEb6Umof9tyDUA8n22G1X/029pN/xPi5b7j3XjNgUIxU/V mOcLXnQkY5JC+zNni/HQzlqqK/RAd/eOon4WTct/6Xgr9A1qnbf74ejmoAVUZ8PCiI0wp2fNCM3 2vGuNvD0H3Thi4d6apHd8pn25CYDdMDmbyUthrCy1kfp6pVWkrWRNiU98VzQTkfXqiMAXuN5mSx L8GjLXlNNWY4erssD5aObCTHNEjovL4zlJsPrCjIs4SDneuzK8g9pRDyPv8bNX1jOgWryjXv7c6 chatNRZb9sXoHVCquZ+bxAQxq4S3oHsrBBl1YRZsRUKd9JRbQoONGyRlg49kH5dSpR63U/cGfgb vBHPZOGagL9HzAuEry9o3885D0ZSI38q4jxg/EEtW9T9YEt4RlFShox5LtxaYF8EckDXXeACyIQ A= X-Google-Smtp-Source: AGHT+IEALuj4P0gRBV3lHJw2QhDugmQDk4nADpDVCK6cv9famhN2Yt9iUEpm+4rfnaEzABbUcDiSAA== X-Received: by 2002:a17:907:1c17:b0:b76:31e6:2ee1 with SMTP id a640c23a62f3a-b8036f65331mr1101190866b.18.1766418143545; Mon, 22 Dec 2025 07:42:23 -0800 (PST) Received: from prometheus ([85.11.110.37]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b8037f0b7bcsm1156790966b.49.2025.12.22.07.42.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Dec 2025 07:42:23 -0800 (PST) From: Szymon Wilczek To: mailhol@kernel.org, mkl@pengutronix.de Cc: arunachalam.santhanam@in.bosch.com, linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, Szymon Wilczek , syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com Subject: [PATCH] can: etas_es58x: fix memory leak in es58x_open() Date: Mon, 22 Dec 2025 16:42:08 +0100 Message-ID: <20251222154208.22117-1-swilczek.lx@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When es58x_alloc_rx_urbs() fails partway through allocating RX URBs (e.g., if usb_submit_urb() fails at iteration i), the function returns an error but leaves any previously allocated and anchored URBs leaked. The issue is that es58x_open() returns directly on es58x_alloc_rx_urbs() failure instead of jumping to the free_urbs label, which would call es58x_free_urbs() to clean up any anchored URBs. Fix this by changing 'return ret' to 'goto free_urbs' to ensure proper cleanup of all allocated URBs on failure. Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN = USB interfaces") Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3De8cb6691a7cf68256cb8 Signed-off-by: Szymon Wilczek --- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/= usb/etas_es58x/es58x_core.c index f799233c2b72..d92c37f277d5 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -1784,7 +1784,7 @@ static int es58x_open(struct net_device *netdev) if (!es58x_dev->opened_channel_cnt) { ret =3D es58x_alloc_rx_urbs(es58x_dev); if (ret) - return ret; + goto free_urbs; =20 ret =3D es58x_set_realtime_diff_ns(es58x_dev); if (ret) --=20 2.52.0