[PATCH] net: usb: ipheth: stop data URBs on ndo_stop

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

ipheth_open() submits the RX URB and ipheth_tx() can submit the TX URB
while the netdev is running.  A successful RX completion resubmits the
RX URB from ipheth_rcvbulk_callback(), so the receive path remains
active until the URB is explicitly stopped.

ipheth_close() stops the netdev queue and disables the carrier work, but
it leaves any submitted data URBs running.  After an administrative link
down, an already submitted RX URB can therefore complete successfully,
account the received packet and pass it to the networking stack, and
then submit the RX URB again even though the interface has been stopped.

The disconnect path already kills the URBs after unregister_netdev(), so
unplug testing eventually quiesces the data path.  The gap is therefore
specific to an administrative close while the USB device remains
connected.

Kill the data URBs from ndo_stop as well.  Do this after disabling
carrier_work: ipheth_sndbulk_callback() schedules the work on TX URB
errors, while disable_delayed_work_sync() prevents a completion caused by
usb_kill_urb() from re-arming it.  usb_kill_urb() also waits for pending
completion handlers and prevents the RX completion from successfully
resubmitting its URB.

Fixes: a19259c3d589 ("drivers/net/usb: Add new driver ipheth")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
---
 drivers/net/usb/ipheth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 2b490114d232..f127aeab7031 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -505,6 +505,7 @@ static int ipheth_close(struct net_device *net)
 	 * it, so that such a schedule_delayed_work() is a no-op.
 	 */
 	disable_delayed_work_sync(&dev->carrier_work);
+	ipheth_kill_urbs(dev);
 	return 0;
 }
 
-- 
2.50.1