]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
usbnet:fix NPE during rx_complete
authorYing Lu <luying1@xiaomi.com>
Wed, 2 Apr 2025 08:58:59 +0000 (16:58 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Apr 2025 12:37:41 +0000 (14:37 +0200)
commitacacd48a37b52fc95f621765762c04152b58d642
tree425dbde63759aa57543261029d2810e608bd9afb
parent032c5407a608ac3b2a98bf4fbda27d12c20c5887
usbnet:fix NPE during rx_complete

commit 51de3600093429e3b712e5f091d767babc5dd6df upstream.

Missing usbnet_going_away Check in Critical Path.
The usb_submit_urb function lacks a usbnet_going_away
validation, whereas __usbnet_queue_skb includes this check.

This inconsistency creates a race condition where:
A URB request may succeed, but the corresponding SKB data
fails to be queued.

Subsequent processes:
(e.g., rx_complete → defer_bh → __skb_unlink(skb, list))
attempt to access skb->next, triggering a NULL pointer
dereference (Kernel Panic).

Fixes: 04e906839a05 ("usbnet: fix cyclical race on disconnect with work queue")
Cc: stable@vger.kernel.org
Signed-off-by: Ying Lu <luying1@xiaomi.com>
Link: https://patch.msgid.link/4c9ef2efaa07eb7f9a5042b74348a67e5a3a7aea.1743584159.git.luying1@xiaomi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/usb/usbnet.c