Re: [syzbot] [net?] [usb?] memory leak in rtl8150_set_multicast
From: Raka Gunarto <hidden>
Date: 2025-12-16 23:23:40
Also in:
linux-usb, lkml
Subsystem:
networking drivers, the rest, usb networking drivers, usb rtl8150 driver · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Petko Manolov
async_set_registers() does not free the urb and req on the usb_submit_urb() call fail path. Fix by freeing both objects. Reported-by: syzbot+8dd915c7cb0490fc8c52@syzkaller.appspotmail.com Signed-off-by: Raka Gunarto <redacted> --- drivers/net/usb/rtl8150.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 278e6cb6f4..0f6c700a85 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c@@ -211,6 +211,8 @@ static int async_set_registers(rtl8150_t *dev, u16indx, u16 size, u16 reg)
if (res == -ENODEV)
netif_device_detach(dev->netdev);
dev_err(&dev->udev->dev, "%s failed with %d\n", __func__, res);
+ usb_free_urb(async_urb);
+ kfree(req);
}
return res;
}
--
2.25.1