Description
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.
Product status
ec5ccc2af9e5b045671f3f604b57512feda8bcc5 (git) before aa8a8866c533a150be4763bcb27993603bd5426c
f905bcfa971edb89e398c98957838d8c6381c0c7 (git) before ce4352057fc5a986c76ece90801b9755e7c6e56c
08624b7206ddb9148eeffc2384ebda2c47b6d1e9 (git) before c610b550ccc0438d456dfe1df9f4f36254ccaae3
9f669a38ca70839229b7ba0f851820850a2fe1f7 (git) before c3edc14da81a8d8398682f6e4ab819f09f37c0b7
7352e1d5932a0e777e39fa4b619801191f57e603 (git) before 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7
6.12.67 (semver) before 6.12.68
6.18.7 (semver) before 6.18.8
References
git.kernel.org/...c/aa8a8866c533a150be4763bcb27993603bd5426c
git.kernel.org/...c/ce4352057fc5a986c76ece90801b9755e7c6e56c
git.kernel.org/...c/c610b550ccc0438d456dfe1df9f4f36254ccaae3
git.kernel.org/...c/c3edc14da81a8d8398682f6e4ab819f09f37c0b7
git.kernel.org/...c/79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7