can: gs_usb: gs_make_candev(): fix memory leak for devices with extended bit timing...

Some CAN-FD capable devices offer extended bit timing information for
the data bit timing. The information must be read with an USB control
message. The memory for this message is allocated but not free()ed (in
the non error case). This patch adds the missing free.

Fixes: 6679f4c5e5a6 ("can: gs_usb: add extended bt_const feature")
Link: https://lore.kernel.org/all/20220329193450.659726-1-mkl@pengutronix.de
Reported-by: syzbot+4d0ae90a195b269f102d@syzkaller.appspotmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 67408e316062137e0a860924e43138045aa14ac1..b29ba9138866b1d926b660095ec61211c6a818b2 100644 (file)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -1092,6 +1092,8 @@ static struct gs_can *gs_make_candev(unsigned int channel,
                dev->data_bt_const.brp_inc = le32_to_cpu(bt_const_extended->dbrp_inc);
 
                dev->can.data_bittiming_const = &dev->data_bt_const;
+
+               kfree(bt_const_extended);
        }
 
        SET_NETDEV_DEV(netdev, &intf->dev);