From: Szymon Wilczek <[email protected]>
Date: 22 Dec 2025
Subject: [PATCH v1] can: etas_es58x: allow partial RX URB allocation to succeed
When es58x_alloc_rx_urbs() fails partway through allocating RX URBs
(e.g., if usb_submit_urb() fails at iteration i), the function returns
an error but leaves any previously allocated and anchored URBs leaked.
The issue is that es58x_open() returns directly on es58x_alloc_rx_urbs()
failure instead of jumping to the free_urbs label, which would call
es58x_free_urbs() to clean up any anchored URBs.
Fix this by changing 'return ret' to 'goto free_urbs' to ensure proper
cleanup of all allocated URBs on failure.
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=e8cb6691a7cf68256cb8
Signed-off-by: Szymon Wilczek <[email protected]> diff
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index f799233c2b72..d92c37f277d5 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -1784,7 +1784,7 @@ static int es58x_open(struct net_device *netdev)
if (!es58x_dev->opened_channel_cnt) {
ret = es58x_alloc_rx_urbs(es58x_dev);
if (ret)
- return ret;
+ goto free_urbs;
ret = es58x_set_realtime_diff_ns(es58x_dev);
if (ret) From: Szymon Wilczek <[email protected]>
Date: 23 Dec 2025
Subject: [PATCH v2] can: etas_es58x: allow partial RX URB allocation to succeed
Merged: 9 Jan 2026, by Marc Kleine-Budde
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error.
Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open().
signed, reported, fixes
- Fixes 8537257874e9 the commit it fixes
- Reported-by syzbot reported it
- Signed-off-by Szymon Wilczek author
- Reviewed-by Vincent Mailhol reviewed it
- Signed-off-by Marc Kleine-Budde maintainer · merged it
diff
@@ -1736,7 +1736,7 @@ static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev) dev_dbg(dev, "%s: Allocated %d rx URBs each of size %u\n", __func__, i, rx_buf_len); - return ret;+ return 0; } /**discussion · on the list
v1 · 2 messages
Szymon Wilczek author 22 Dec 2025
[PATCH] can: etas_es58x: fix memory leak in es58x_open()
Vincent Mailhol reviewer 22 Dec 2025
v2 · 3 messages
Szymon Wilczek author 23 Dec 2025
[PATCH v2] can: etas_es58x: allow partial RX URB allocation to succeed
Vincent Mailhol reviewer 23 Dec 2025
Marc Kleine-Budde maintainer 24 Dec 2025