Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752612AbcDRC3h (ORCPT ); Sun, 17 Apr 2016 22:29:37 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:35426 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752324AbcDRC13 (ORCPT ); Sun, 17 Apr 2016 22:27:29 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , "David S. Miller" Subject: [PATCH 3.14 13/37] usbnet: cleanup after bind() in probe() Date: Mon, 18 Apr 2016 11:25:45 +0900 Message-Id: <20160418022401.408295165@linuxfoundation.org> X-Mailer: git-send-email 2.8.0 In-Reply-To: <20160418022400.661946311@linuxfoundation.org> References: <20160418022400.661946311@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1235 Lines: 39 3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Neukum [ Upstream commit 1666984c8625b3db19a9abc298931d35ab7bc64b ] In case bind() works, but a later error forces bailing in probe() in error cases work and a timer may be scheduled. They must be killed. This fixes an error case related to the double free reported in http://www.spinics.net/lists/netdev/msg367669.html and needs to go on top of Linus' fix to cdc-ncm. Signed-off-by: Oliver Neukum Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/usbnet.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1718,6 +1718,13 @@ out3: if (info->unbind) info->unbind (dev, udev); out1: + /* subdrivers must undo all they did in bind() if they + * fail it, but we may fail later and a deferred kevent + * may trigger an error resubmitting itself and, worse, + * schedule a timer. So we kill it all just in case. + */ + cancel_work_sync(&dev->kevent); + del_timer_sync(&dev->delay); free_netdev(net); out: return status;