]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
authorMarc Kleine-Budde <mkl@pengutronix.de>
Sat, 10 Jan 2026 11:52:27 +0000 (12:52 +0100)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Fri, 16 Jan 2026 19:40:46 +0000 (20:40 +0100)
commit710a7529fb13c5a470258ff5508ed3c498d54729
treef0adf4bdb150eebd8ca0bd8d7c46287a1c9bcff9
parent248e8e1a125fa875158df521b30f2cc7e27eeeaa
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").

In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are
allocated, added to the priv->rx_submitted anchor and submitted. In the
complete callback mcba_usb_read_bulk_callback(), the URBs are processed and
resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by
calling usb_kill_anchored_urbs(&priv->rx_submitted).

However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in usb_kill_anchored_urbs().

Fix the memory leak by anchoring the URB in the
mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.

Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-4-4b8cb2915571@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
drivers/net/can/usb/mcba_usb.c