From: Dongliang Mu <mudongliangabcd@xxxxxxxxx> The error handling code of peak_usb_create_dev forgets to reset the next_siblings of previous entry. Fix this by nullifying the (dev->prev_siblings)->next_siblings in the error handling code. Signed-off-by: Dongliang Mu <mudongliangabcd@xxxxxxxxx> --- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c index b850ff8fe4bd..f858810221b6 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c @@ -894,6 +894,9 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, dev->adapter->dev_free(dev); lbl_unregister_candev: + /* remove the dangling pointer in next_siblings */ + if (dev->prev_siblings) + (dev->prev_siblings)->next_siblings = NULL; unregister_candev(netdev); lbl_restore_intf_data: -- 2.25.1
