Re: [PATCH net] net: usb: ipheth: fix carrier_work UAF on disconnect

[Jakub Kicinski]

On Fri, 24 Jul 2026 15:42:50 +0200 Doruk Tan Ozturk wrote:
> ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero
> URB status:
> 
> 	else
> 		schedule_delayed_work(&dev->carrier_work, 0);
> 
> ipheth_disconnect() drains that work via unregister_netdev() ->
> ipheth_close() -> cancel_delayed_work_sync(), and only then kills the URBs
> with ipheth_kill_urbs(). usb_kill_urb() completes any in-flight TX URB
> synchronously with -ENOENT, so ipheth_sndbulk_callback() runs after the
> drain and re-arms carrier_work. free_netdev() then frees the netdev
> whose private area embeds carrier_work, and the pending
> ipheth_carrier_check_work() dereferences the freed device, a
> use-after-free on unplug while a TX URB is in flight.
> 
> Drain carrier_work again after the URB source is stopped and before the
> netdev is freed.

Doesn't look very clean. Maybe we can check netif_running() before
scheduling? Or disable / enable the work.
-- 
pw-bot: cr