[PATCH net v2] net: usb: ipheth: stop RX URB on ndo_stop

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

ipheth_open() submits the RX URB, and a successful RX completion
resubmits it from ipheth_rcvbulk_callback(). ipheth_close() stops the
netdev queue and disables the carrier work, but leaves the RX URB
running.

After an administrative link down, an already submitted RX URB can
therefore complete, pass received packets to the networking stack, and
submit itself again even though the interface has been stopped.

Stop the RX URB from ndo_stop. Do not kill the TX URB: packets in a
successfully submitted TX URB have already been accounted as transmitted,
so let an in-flight TX complete normally after the queue has been
stopped.

usb_kill_urb() waits for a pending RX completion to finish and prevents
the completion handler from successfully resubmitting the URB.

Fixes: a19259c3d589 ("drivers/net/usb: Add new driver ipheth")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
---
v2:
- Kill only the RX URB and leave an in-flight TX URB to complete
  normally, as pointed out by Oliver Neukum.

 drivers/net/usb/ipheth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 2b490114d232..6b90fe1e0e38 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -505,6 +505,7 @@ static int ipheth_close(struct net_device *net)
 	 * it, so that such a schedule_delayed_work() is a no-op.
 	 */
 	disable_delayed_work_sync(&dev->carrier_work);
+	usb_kill_urb(dev->rx_urb);
 	return 0;
 }
 
-- 
2.50.1