[PATCH 1/6] can: esd_usb: Fix possible calls to kfree() with NULL
From: Stefan Mätje <stefan.maetje@esd.eu>
Date: 2025-08-11 21:06:15
Also in:
linux-can
Subsystem:
can network drivers, esd can/usb drivers, the rest · Maintainers:
Marc Kleine-Budde, Vincent Mailhol, Frank Jungclaus, Linus Torvalds
In esd_usb_start() kfree() is called with the msg variable even if the allocation of *msg failed. Move the kfree() call to a line before the allocation error exit label out: and adjust the exits for other errors to the new free_msg: label just before kfree(). In esd_usb_probe() add free_dev: label and skip calling kfree() if allocation of *msg failed. Fixes: fae37f81fdf3 ( "net: can: esd_usb2: Do not do dma on the stack" ) Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu> --- drivers/net/can/usb/esd_usb.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
index 27a3818885c2..05ed664cf59d 100644
--- a/drivers/net/can/usb/esd_usb.c
+++ b/drivers/net/can/usb/esd_usb.c@@ -3,7 +3,7 @@ * CAN driver for esd electronics gmbh CAN-USB/2, CAN-USB/3 and CAN-USB/Micro * * Copyright (C) 2010-2012 esd electronic system design gmbh, Matthias Fuchs <socketcan@esd.eu> - * Copyright (C) 2022-2024 esd electronics gmbh, Frank Jungclaus <frank.jungclaus@esd.eu> + * Copyright (C) 2022-2025 esd electronics gmbh, Frank Jungclaus <frank.jungclaus@esd.eu> */ #include <linux/can.h>
@@ -746,21 +746,22 @@ static int esd_usb_start(struct esd_usb_net_priv *priv) err = esd_usb_send_msg(dev, msg); if (err) - goto out; + goto free_msg; err = esd_usb_setup_rx_urbs(dev); if (err) - goto out; + goto free_msg; priv->can.state = CAN_STATE_ERROR_ACTIVE; +free_msg: + kfree(msg); out: if (err == -ENODEV) netif_device_detach(netdev); if (err) netdev_err(netdev, "couldn't start device: %d\n", err); - kfree(msg); return err; }
@@ -1279,7 +1280,7 @@ static int esd_usb_probe(struct usb_interface *intf, dev = kzalloc(sizeof(*dev), GFP_KERNEL); if (!dev) { err = -ENOMEM; - goto done; + goto bail; } dev->udev = interface_to_usbdev(intf);
@@ -1291,7 +1292,7 @@ static int esd_usb_probe(struct usb_interface *intf, msg = kmalloc(sizeof(*msg), GFP_KERNEL); if (!msg) { err = -ENOMEM; - goto free_msg; + goto free_dev; } /* query number of CAN interfaces (nets) */
@@ -1334,9 +1335,10 @@ static int esd_usb_probe(struct usb_interface *intf, free_msg: kfree(msg); +free_dev: if (err) kfree(dev); -done: +bail: return err; }
--
2.34.1