On unbind, the Sierra USB WWAN driver cancels the sierra_net_kevent()
work, then stops polling for interrupts by calling usbnet_status_stop().
However the interrupt handler sierra_net_status() may re-schedule the
work after it's been canceled and thus cause a use-after-free.
Fix by inverting the teardown order.
Fixes: 7b0c5f21f348 ("sierra_net: keep status interrupt URB active")
Signed-off-by: Lukas Wunner <lukas@xxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx # v3.10+
Cc: Dan Williams <dan.j.williams@xxxxxxxxx>
---
drivers/net/usb/sierra_net.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index bb4cbe8fc846..197e1356ae98 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -758,6 +758,8 @@ static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
dev_dbg(&dev->udev->dev, "%s", __func__);
+ usbnet_status_stop(dev);
+
/* kill the timer and work */
del_timer_sync(&priv->sync_timer);
cancel_work_sync(&priv->sierra_net_kevent);
@@ -769,8 +771,6 @@ static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
netdev_err(dev->net,
"usb_control_msg failed, status %d\n", status);
- usbnet_status_stop(dev);
-
sierra_net_set_private(dev, NULL);
kfree(priv);
}
--
2.35.2
