Re: [PATCH] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback

[Vincent Mailhol <mailhol@kernel.org>]

On 23/02/2026 at 17:39, Greg Kroah-Hartman wrote:
> When submitting an urb, that is using the anchor pattern, it needs to be
> anchored before submitting it otherwise it could be leaked if
> usb_kill_anchored_urbs() is called.  This logic is correctly done
> elsewhere in the driver, except in the read bulk callback so do that
> here also.

I can explain why this bug went through the cracks. When I wrote this
driver, I was actually wondering whether I had to manually re-anchor the
urbs. I checked the documentation of usb_submit_urb() and
usb_fill_bulk_urb() but there was no mention that the urb will be
unachored by the framework before calling urb->complete(). And so, I
assumed that it would stay anchored. And I ended up just anchoring them
once at creation and then reuse them without paying attention to the
anchor any more.

Now that I see your patch, I had a look at the code source and can see
that indeed __usb_hcd_giveback_urb() will unanchor the urbs.

Anyway, thanks for the fix!

> Cc: Vincent Mailhol <mailhol@kernel.org>
> Cc: Marc Kleine-Budde <mkl@pengutronix.de>
> Cc: stable <stable@kernel.org>
> Assisted-by: gkh_clanker_2000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Tested-by: Vincent Mailhol <mailhol@kernel.org>


Yours sincerely,
Vincent Mailhol