• Yu Zhao's avatar
    net/usb: cancel pending work when unbinding smsc75xx · f7b2a56e
    Yu Zhao authored
    Cancel pending work before freeing smsc75xx private data structure
    during binding. This fixes the following crash in the driver:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
    IP: mutex_lock+0x2b/0x3f
    <snipped>
    Workqueue: events smsc75xx_deferred_multicast_write [smsc75xx]
    task: ffff8caa83e85700 task.stack: ffff948b80518000
    RIP: 0010:mutex_lock+0x2b/0x3f
    <snipped>
    Call Trace:
     smsc75xx_deferred_multicast_write+0x40/0x1af [smsc75xx]
     process_one_work+0x18d/0x2fc
     worker_thread+0x1a2/0x269
     ? pr_cont_work+0x58/0x58
     kthread+0xfa/0x10a
     ? pr_cont_work+0x58/0x58
     ? rcu_read_unlock_sched_notrace+0x48/0x48
     ret_from_fork+0x22/0x40
    Signed-off-by: default avatarYu Zhao <yuzhao@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    f7b2a56e
smsc75xx.c 57.3 KB