From: Xu Rao ipheth_open() submits the RX URB and ipheth_tx() can submit the TX URB while the netdev is running. A successful RX completion resubmits the RX URB from ipheth_rcvbulk_callback(), so the receive path remains active until the URB is explicitly stopped. ipheth_close() stops the netdev queue and disables the carrier work, but it leaves any submitted data URBs running. After an administrative link down, an already submitted RX URB can therefore complete successfully, account the received packet and pass it to the networking stack, and then submit the RX URB again even though the interface has been stopped. The disconnect path already kills the URBs after unregister_netdev(), so unplug testing eventually quiesces the data path. The gap is therefore specific to an administrative close while the USB device remains connected. Kill the data URBs from ndo_stop as well. Do this after disabling carrier_work: ipheth_sndbulk_callback() schedules the work on TX URB errors, while disable_delayed_work_sync() prevents a completion caused by usb_kill_urb() from re-arming it. usb_kill_urb() also waits for pending completion handlers and prevents the RX completion from successfully resubmitting its URB. Fixes: a19259c3d589 ("drivers/net/usb: Add new driver ipheth") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao --- drivers/net/usb/ipheth.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 2b490114d232..f127aeab7031 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -505,6 +505,7 @@ static int ipheth_close(struct net_device *net) * it, so that such a schedule_delayed_work() is a no-op. */ disable_delayed_work_sync(&dev->carrier_work); + ipheth_kill_urbs(dev); return 0; } -- 2.50.1