When usbnet_disconnect() queued while usbnet_probe() processing, it results to free_netdev before kevent gets to run on workqueue, thus workqueue does assign_work() with referencing freeed memory address. For graceful disconnect and to prevent use-after-free of netdev pointer, the fix adds canceling work and timer those are placed by usbnet_probe() Signed-off-by: Peter GJ. Park Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") --- drivers/net/usb/usbnet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index c04e715a4c2a..3c5d9ba7fa66 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1660,6 +1660,9 @@ void usbnet_disconnect (struct usb_interface *intf) usb_free_urb(dev->interrupt); kfree(dev->padding_pkt); + timer_delete_sync(&dev->delay); + tasklet_kill(&dev->bh); + cancel_work_sync(&dev->kevent); free_netdev(net); } EXPORT_SYMBOL_GPL(usbnet_disconnect); -- 2.25.1