Commit 51de3600 authored by Ying Lu's avatar Ying Lu Committed by Jakub Kicinski
Browse files

usbnet:fix NPE during rx_complete 



Missing usbnet_going_away Check in Critical Path.
The usb_submit_urb function lacks a usbnet_going_away
validation, whereas __usbnet_queue_skb includes this check.

This inconsistency creates a race condition where:
A URB request may succeed, but the corresponding SKB data
fails to be queued.

Subsequent processes:
(e.g., rx_complete → defer_bh → __skb_unlink(skb, list))
attempt to access skb->next, triggering a NULL pointer
dereference (Kernel Panic).

Fixes: 04e90683 ("usbnet: fix cyclical race on disconnect with work queue")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarYing Lu <luying1@xiaomi.com>
Link: https://patch.msgid.link/4c9ef2efaa07eb7f9a5042b74348a67e5a3a7aea.1743584159.git.luying1@xiaomi.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 2a837772

drivers/net/usb/usbnet.c

+3 −3
Original line number Diff line number Diff line
@@ -530,7 +530,8 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) 
	    netif_device_present (dev->net) &&

	    test_bit(EVENT_DEV_OPEN, &dev->flags) &&

	    !test_bit (EVENT_RX_HALT, &dev->flags) &&

	    !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) {

	    !test_bit (EVENT_DEV_ASLEEP, &dev->flags) &&

	    !usbnet_going_away(dev)) {

		switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) {

		case -EPIPE:

			usbnet_defer_kevent (dev, EVENT_RX_HALT);
@@ -551,7 +552,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) 
			tasklet_schedule (&dev->bh);

			break;

		case 0:

			if (!usbnet_going_away(dev))

			__usbnet_queue_skb(&dev->rxq, skb, rx_start);

		}

	} else {