[PATCH net-next v3] net: usb: lan78xx: fix error handling in lan78xx_open()

[Stefano Munari]

A failed interrupt URB submission leaves NAPI enabled and EVENT_DEV_OPEN
set. A subsequent open enables NAPI again, triggering BUG_ON() in
napi_enable().

Clear EVENT_DEV_OPEN and disable NAPI on the submission error path.

Reproduced using failslab on a Raspberry Pi 3 Model B+ (LAN7515).
With the fix, the injected allocation failure returns -ENOMEM and a
subsequent open succeeds. Verified connectivity with ping and SSH.

Signed-off-by: Stefano Munari <stefanomunari.sm@xxxxxxxxx>
Reviewed-by: Nicolai Buchwitz <nb@xxxxxxxxxxx>
---
v3:
- Target net-next and drop the Fixes tag as requested by Andrew.
v2: https://lore.kernel.org/netdev/20261020202614.30277-1-stefanomunari.sm@xxxxxxxxx
- Move cleanup code to err_napi unwind label as suggested by Nicolai.
- Add Nicolai's Reviewed-by tag.
v1: https://lore.kernel.org/netdev/20261016000521.92868-1-stefanomunari.sm@xxxxxxxxx
---
 drivers/net/usb/lan78xx.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 181e8c087..d73002b2c 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3497,17 +3497,20 @@ static int lan78xx_open(struct net_device *net)
 		if (ret < 0) {
 			netif_err(dev, ifup, dev->net,
 				  "intr submit %d\n", ret);
-			goto done;
+			goto err_napi;
 		}
 	}
 
 	phylink_start(dev->phylink);
-
-done:
 	mutex_unlock(&dev->dev_mutex);
 
-	if (ret < 0)
-		usb_autopm_put_interface(dev->intf);
+	return 0;
+
+err_napi:
+	clear_bit(EVENT_DEV_OPEN, &dev->flags);
+	napi_disable(&dev->napi);
+	mutex_unlock(&dev->dev_mutex);
+	usb_autopm_put_interface(dev->intf);
 
 	return ret;
 }
-- 
2.55.0