| From foo@baz Sat Apr 16 22:36:37 PDT 2016 |
| From: Oliver Neukum <oneukum@suse.com> |
| Date: Mon, 7 Mar 2016 11:31:10 +0100 |
| Subject: usbnet: cleanup after bind() in probe() |
| Status: RO |
| Content-Length: 1136 |
| Lines: 36 |
| |
| From: Oliver Neukum <oneukum@suse.com> |
| |
| [ Upstream commit 1666984c8625b3db19a9abc298931d35ab7bc64b ] |
| |
| In case bind() works, but a later error forces bailing |
| in probe() in error cases work and a timer may be scheduled. |
| They must be killed. This fixes an error case related to |
| the double free reported in |
| http://www.spinics.net/lists/netdev/msg367669.html |
| and needs to go on top of Linus' fix to cdc-ncm. |
| |
| Signed-off-by: Oliver Neukum <ONeukum@suse.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/usb/usbnet.c | 7 +++++++ |
| 1 file changed, 7 insertions(+) |
| |
| --- a/drivers/net/usb/usbnet.c |
| +++ b/drivers/net/usb/usbnet.c |
| @@ -1718,6 +1718,13 @@ out3: |
| if (info->unbind) |
| info->unbind (dev, udev); |
| out1: |
| + /* subdrivers must undo all they did in bind() if they |
| + * fail it, but we may fail later and a deferred kevent |
| + * may trigger an error resubmitting itself and, worse, |
| + * schedule a timer. So we kill it all just in case. |
| + */ |
| + cancel_work_sync(&dev->kevent); |
| + del_timer_sync(&dev->delay); |
| free_netdev(net); |
| out: |
| return status; |
