Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: usb: rtl8150: fix memory leak on usb_submit_urb() failure

In async_set_registers(), when usb_submit_urb() fails, the allocated
async_req structure and URB are not freed, causing a memory leak.

The completion callback async_set_reg_cb() is responsible for freeing
these allocations, but it is only called after the URB is successfully
submitted and completes (successfully or with error). If submission
fails, the callback never runs and the memory is leaked.

Fix this by freeing both the URB and the request structure in the error
path when usb_submit_urb() fails.

Reported-by: syzbot+8dd915c7cb0490fc8c52@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8dd915c7cb0490fc8c52
Fixes: 4d12997a9bb3 ("drivers: net: usb: rtl8150: concurrent URB bugfix")
Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
Link: https://patch.msgid.link/20251216151304.59865-2-dkarn@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

Deepakkumar Karn and committed by
Paolo Abeni
12cab119 dff94bc6

+2
+2
drivers/net/usb/rtl8150.c
··· 211 211 if (res == -ENODEV) 212 212 netif_device_detach(dev->netdev); 213 213 dev_err(&dev->udev->dev, "%s failed with %d\n", __func__, res); 214 + kfree(req); 215 + usb_free_urb(async_urb); 214 216 } 215 217 return res; 216 218 }