Re: [PATCH] can: gs_usb: kill RX URBs before destroying the netdevs

[Marc Kleine-Budde]

On 26.10.2026 22:09:08, Marc Kleine-Budde wrote:
> > diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
> > index ec9a7cb..663746d 100644
> > --- a/drivers/net/can/usb/gs_usb.c
> > +++ b/drivers/net/can/usb/gs_usb.c
> > @@ -1595,10 +1595,10 @@ static int gs_usb_probe(struct usb_interface *intf,
> >
> >  			/* on failure destroy previously created candevs */
> >  			icount = i;
> > +			usb_kill_anchored_urbs(&parent->rx_submitted);
>
> I've fixed the root cause of this problem. Do not register an interface,
> before all interfaces are setup:
>
> https://lore.kernel.org/all/20261026-gs_usb-fixes-v4-2-59e3b6360053@xxxxxxxxxxxxxx/
>
> >  			for (i = 0; i < icount; i++)
> >  				gs_destroy_candev(parent->canch[i]);
> >
> > -			usb_kill_anchored_urbs(&parent->rx_submitted);
> >  			kfree(parent);
> >  			return rc;
> >  		}
> > @@ -1636,6 +1636,8 @@ static void gs_usb_disconnect(struct usb_interface *intf)
> >  		return;
> >  	}
> >
> > +	usb_kill_anchored_urbs(&parent->rx_submitted);
> > +
>
> The USB core disables all endpoints before calling gs_usb_disconnect(),
> so this isn't needed.

This is not 100% correct. There is a small race window, that the
URB's callbacks have not completed. I'll fix this by first un-registering
the netdev and then freeing the ressources.

>
> >  	for (i = 0; i < parent->channel_cnt; i++)
> >  		if (parent->canch[i])
> >  			gs_destroy_candev(parent->canch[i]);

Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Attachment: signature.asc
Description: PGP signature