| Message ID | cover.1743584159.git.luying1@xiaomi.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | usbnet:fix NPE during rx_complete | expand |
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Wed, 2 Apr 2025 16:58:58 +0800 you wrote: > From: Ying Lu <luying1@xiaomi.com> > > The patchset fix the issue caused by the following modifications: > commit 04e906839a053f092ef53f4fb2d610983412b904 > (usbnet: fix cyclical race on disconnect with work queue) > > The issue: > The usb_submit_urb function lacks a usbnet_going_away validation, > whereas __usbnet_queue_skb includes this check. This inconsistency > creates a race condition where: A URB request may succeed, but > the corresponding SKB data fails to be queued. > > [...] Here is the summary with links: - [v4,1/1] usbnet:fix NPE during rx_complete https://git.kernel.org/netdev/net/c/51de36000934 You are awesome, thank you!
From: Ying Lu <luying1@xiaomi.com> The patchset fix the issue caused by the following modifications: commit 04e906839a053f092ef53f4fb2d610983412b904 (usbnet: fix cyclical race on disconnect with work queue) The issue: The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check. This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued. Subsequent processes (e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic). Fix issue: adding the usbnet_going_away check in usb_submit_urb to synchronize the validation logic. Changes in v4 -use the correct "Cc:" tag format. Changes in v3 -use the correct "Fixes:" tag format. Changes in v2 -Use the formal name instead of an email alias. Ying Lu (1): usbnet:fix NPE during rx_complete drivers/net/usb/usbnet.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)