[PATCH v3] can: usb: etas_es58x: Fix RX buffer leak on URB resubmit failure

[PATCH v3] can: usb: etas_es58x: Fix RX buffer leak on URB resubmit failure

[Guangshuo Li]

es58x_read_bulk_callback() resubmits the RX URB after processing a
received packet. If the resubmit succeeds, the URB remains anchored and
will be handled by the normal RX path or by teardown.

However, if usb_submit_urb() fails, the callback unanchors the URB and
then returns directly. This skips the existing free_urb path, so the
coherent transfer buffer allocated with usb_alloc_coherent() is not
released.

Reuse the existing free_urb path after a resubmit failure so that the RX
coherent buffer is freed before leaving the callback.

Fixes: 5eaad4f76826 ("can: usb: etas_es58x: correctly anchor the urb in the read bulk callback")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
---
v3:
  - Regenerate the patch against the correct base so it removes the
  original return statement instead of the v1-added goto.
  - Add the missing changelog. No functional change intended.

v2:
  - Remove the redundant goto and let the error path fall through to
    free_urb, as suggested by Vincent Mailhol.
  - Add Vincent's Reviewed-by tag

 drivers/net/can/usb/etas_es58x/es58x_core.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index b259f6109808..e1724ae79c5a 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -1476,7 +1476,6 @@ static void es58x_read_bulk_callback(struct urb *urb)
 		dev_err_ratelimited(dev,
 				    "Failed resubmitting read bulk urb: %pe\n",
 				    ERR_PTR(ret));
-	return;
 
  free_urb:
 	usb_free_coherent(urb->dev, urb->transfer_buffer_length,
-- 
2.43.0

Re: [PATCH v3] can: usb: etas_es58x: Fix RX buffer leak on URB resubmit failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The TX URB is accessed after it is freed when es58x_submit_urb() fails, leading to a double free and Use-After-Free.
- [High] usb_free_coherent() is called from an URB completion handler (atomic context), violating IRQ context safety rules.
--

commit fe545bd17f0a8dbd30c2399351f0a4beb7cf3f76
Author: Guangshuo Li <lgs201920130244@gmail.com>

can: usb: etas_es58x: Fix RX buffer leak on URB resubmit failure

es58x_read_bulk_callback() resubmits the RX URB after processing a
received packet. If the resubmit succeeds, the URB remains anchored and
will be handled by the normal RX path or by teardown.

> diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
> index b259f61098083..e1724ae79c5a1 100644
> --- a/drivers/net/can/usb/etas_es58x/es58x_core.c
> +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
> @@ -1476,7 +1476,6 @@ static void es58x_read_bulk_callback(struct urb *urb)
>  		dev_err_ratelimited(dev,
>  				    "Failed resubmitting read bulk urb: %pe\n",
>  				    ERR_PTR(ret));
> -	return;
>  
>   free_urb:
>  	usb_free_coherent(urb->dev, urb->transfer_buffer_length,

[Severity: High]
This is a pre-existing issue, but does removing this return statement expand a 
bug where usb_free_coherent() is called from an URB completion handler?

es58x_read_bulk_callback() executes in atomic context. usb_free_coherent()
wraps dma_free_coherent() which may sleep on some architectures when unmapping
memory. 

Can this cause a "BUG: scheduling while atomic" panic during RX resubmit
failure?

[Severity: High]
This isn't a bug introduced by this patch, but does the transmit error path have 
a double free when es58x_submit_urb() fails?

If usb_submit_urb() fails during packet transmission:

drivers/net/can/usb/etas_es58x/es58x_core.c:es58x_submit_urb() {
	...
	usb_unanchor_urb(urb);
	...
	usb_free_urb(urb);
}

The pointer is only set to NULL on success, leaving it dangling on failure:

drivers/net/can/usb/etas_es58x/es58x_core.c:es58x_xmit_commit() {
	...
	ret = es58x_submit_urb(priv->es58x_dev, priv->tx_urb, netdev);
	if (ret == 0)
		priv->tx_urb = NULL;
}

Then es58x_start_xmit() jumps to xmit_failure and calls 
es58x_flush_pending_tx_msg(), which uses the dangling pointer:

drivers/net/can/usb/etas_es58x/es58x_core.c:es58x_flush_pending_tx_msg() {
	...
	usb_anchor_urb(priv->tx_urb, &priv->es58x_dev->tx_urbs_idle);
	...
	usb_free_urb(priv->tx_urb);
}

Can this lead to a use-after-free and memory corruption?

>  			  urb->transfer_buffer, urb->transfer_dma);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706014601.415445-1-lgs201920130244@gmail.com?part=1

Re: [PATCH v3] can: usb: etas_es58x: Fix RX buffer leak on URB resubmit failure

[Greg Kroah-Hartman]

On Mon, Jul 06, 2026 at 09:46:01AM +0800, Guangshuo Li wrote:
> es58x_read_bulk_callback() resubmits the RX URB after processing a
> received packet. If the resubmit succeeds, the URB remains anchored and
> will be handled by the normal RX path or by teardown.
> 
> However, if usb_submit_urb() fails, the callback unanchors the URB and
> then returns directly. This skips the existing free_urb path, so the
> coherent transfer buffer allocated with usb_alloc_coherent() is not
> released.
> 
> Reuse the existing free_urb path after a resubmit failure so that the RX
> coherent buffer is freed before leaving the callback.
> 
> Fixes: 5eaad4f76826 ("can: usb: etas_es58x: correctly anchor the urb in the read bulk callback")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
> ---
> v3:
>   - Regenerate the patch against the correct base so it removes the
>   original return statement instead of the v1-added goto.
>   - Add the missing changelog. No functional change intended.
> 
> v2:
>   - Remove the redundant goto and let the error path fall through to
>     free_urb, as suggested by Vincent Mailhol.
>   - Add Vincent's Reviewed-by tag
> 
>  drivers/net/can/usb/etas_es58x/es58x_core.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
> index b259f6109808..e1724ae79c5a 100644
> --- a/drivers/net/can/usb/etas_es58x/es58x_core.c
> +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
> @@ -1476,7 +1476,6 @@ static void es58x_read_bulk_callback(struct urb *urb)
>  		dev_err_ratelimited(dev,
>  				    "Failed resubmitting read bulk urb: %pe\n",
>  				    ERR_PTR(ret));
> -	return;
>  
>   free_urb:
>  	usb_free_coherent(urb->dev, urb->transfer_buffer_length,
> -- 
> 2.43.0
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- You have marked a patch with a "Fixes:" tag for a commit that is in an
  older released kernel, yet you do not have a cc: stable line in the
  signed-off-by area at all, which means that the patch will not be
  applied to any older kernel releases.  To properly fix this, please
  follow the documented rules in the
  Documentation/process/stable-kernel-rules.rst file for how to resolve
  this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot