UPSTREAM: usbnet:fix NPE during rx_complete
Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check. This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued. Subsequent processes: (e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic). Fixes: 04e90683 ("usbnet: fix cyclical race on disconnect with work queue") Cc: stable@vger.kernel.org Signed-off-by:Ying Lu <luying1@xiaomi.com> Link: https://patch.msgid.link/4c9ef2efaa07eb7f9a5042b74348a67e5a3a7aea.1743584159.git.luying1@xiaomi.com Signed-off-by:
Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 51de3600) Bug: 407666077 Bug: 426090643 Change-Id: I02ae4319d03e78ced2d91df20fbc7321198b8d70 Signed-off-by:
Ying Lu <luying1@xiaomi.corp-partner.google.com> (cherry picked from commit af63db2f) Signed-off-by:
Gina Ko <yichunko@google.com>
Loading
Please sign in to comment