Skip to content

Commit 1666984

Browse files
oneukumdavem330
authored andcommitted
usbnet: cleanup after bind() in probe()
In case bind() works, but a later error forces bailing in probe() in error cases work and a timer may be scheduled. They must be killed. This fixes an error case related to the double free reported in http://www.spinics.net/lists/netdev/msg367669.html and needs to go on top of Linus' fix to cdc-ncm. Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent a383b7f commit 1666984

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

Diff for: drivers/net/usb/usbnet.c

+7
Original file line numberDiff line numberDiff line change
@@ -1769,6 +1769,13 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
17691769
if (info->unbind)
17701770
info->unbind (dev, udev);
17711771
out1:
1772+
/* subdrivers must undo all they did in bind() if they
1773+
* fail it, but we may fail later and a deferred kevent
1774+
* may trigger an error resubmitting itself and, worse,
1775+
* schedule a timer. So we kill it all just in case.
1776+
*/
1777+
cancel_work_sync(&dev->kevent);
1778+
del_timer_sync(&dev->delay);
17721779
free_netdev(net);
17731780
out:
17741781
return status;

0 commit comments

Comments
 (0)