usbnet:fix NPE during rx_complete
authorYing Lu <luying1@xiaomi.com>
Wed, 2 Apr 2025 08:58:59 +0000 (16:58 +0800)
committerJakub Kicinski <kuba@kernel.org>
Fri, 4 Apr 2025 14:24:46 +0000 (07:24 -0700)
commit51de3600093429e3b712e5f091d767babc5dd6df
tree2d5117ceacca7347216fec265450756867ccc272
parent2a8377720a0a30fa133f7773e901598f7d563f36
usbnet:fix NPE during rx_complete

Missing usbnet_going_away Check in Critical Path.
The usb_submit_urb function lacks a usbnet_going_away
validation, whereas __usbnet_queue_skb includes this check.

This inconsistency creates a race condition where:
A URB request may succeed, but the corresponding SKB data
fails to be queued.

Subsequent processes:
(e.g., rx_complete → defer_bh → __skb_unlink(skb, list))
attempt to access skb->next, triggering a NULL pointer
dereference (Kernel Panic).

Fixes: 04e906839a05 ("usbnet: fix cyclical race on disconnect with work queue")
Cc: stable@vger.kernel.org
Signed-off-by: Ying Lu <luying1@xiaomi.com>
Link: https://patch.msgid.link/4c9ef2efaa07eb7f9a5042b74348a67e5a3a7aea.1743584159.git.luying1@xiaomi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/usb/usbnet.c