The PCAN-USB adapter uses a restart_timer for bus error recovery but does not define a dev_free callback. When the device is unplugged, peak_usb_disconnect() frees the candev without cancelling the timer. If a bus error armed the timer and USB disconnect races with the timer callback, the timer fires on freed memory. The same timer is initialized in pcan_usb_init() via timer_setup(), but on error (e.g. failed USB command to read the serial number) the function returns without cancelling it. Because dev_init failure in peak_usb_create_dev() jumps to lbl_unregister_candev and skips the adap_dev_free label, the dev_free callback is never invoked either. Add a pcan_usb_free() callback that calls timer_shutdown_sync() on the restart_timer, register it as the adapter dev_free handler, and also cancel the timer directly in pcan_usb_init() on error before returning. Fixes: 46be265d3388 ("can: usb: PEAK-System Technik PCAN-USB specific part") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/net/can/usb/peak_usb/pcan_usb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c index 8fd058c328564e..440d8e2cfb6fe6 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb.c @@ -882,6 +882,14 @@ static int pcan_usb_start(struct peak_usb_device *dev) return pcan_usb_set_ext_vcc(dev, 0); } +static void pcan_usb_free(struct peak_usb_device *dev) +{ + struct pcan_usb *pdev = + container_of(dev, struct pcan_usb, dev); + + timer_shutdown_sync(&pdev->restart_timer); +} + static int pcan_usb_init(struct peak_usb_device *dev) { struct pcan_usb *pdev = container_of(dev, struct pcan_usb, dev); @@ -901,6 +909,7 @@ static int pcan_usb_init(struct peak_usb_device *dev) dev_err(dev->netdev->dev.parent, "unable to read %s serial number (err %d)\n", pcan_usb.name, err); + timer_shutdown_sync(&pdev->restart_timer); return err; } @@ -1051,6 +1060,7 @@ const struct peak_usb_adapter pcan_usb = { .dev_decode_buf = pcan_usb_decode_buf, .dev_encode_msg = pcan_usb_encode_msg, .dev_start = pcan_usb_start, + .dev_free = pcan_usb_free, .dev_restart_async = pcan_usb_restart_async, .do_get_berr_counter = pcan_usb_get_berr_counter, }; -- 2.47.3