From: Tristan Madani The PCAN-USB adapter uses a restart_timer for bus error recovery but does not define a dev_free callback. When the device is unplugged, peak_usb_disconnect() calls free_candev() without cancelling the timer. If a bus error armed the timer via mod_timer() and USB disconnect races with it, the timer fires on freed memory. Add a pcan_usb_free() callback that cancels the restart_timer, and register it as the adapter dev_free handler. Fixes: 46be265d3388 ("can: usb: PEAK-System Technik PCAN-USB specific part") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/net/can/usb/peak_usb/pcan_usb.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c index 8fd058c328564..b0b3c76b2ccb8 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb.c @@ -882,6 +882,14 @@ static int pcan_usb_start(struct peak_usb_device *dev) return pcan_usb_set_ext_vcc(dev, 0); } +static void pcan_usb_free(struct peak_usb_device *dev) +{ + struct pcan_usb *pdev = + container_of(dev, struct pcan_usb, dev); + + timer_shutdown_sync(&pdev->restart_timer); +} + static int pcan_usb_init(struct peak_usb_device *dev) { struct pcan_usb *pdev = container_of(dev, struct pcan_usb, dev); @@ -1051,6 +1059,7 @@ const struct peak_usb_adapter pcan_usb = { .dev_decode_buf = pcan_usb_decode_buf, .dev_encode_msg = pcan_usb_encode_msg, .dev_start = pcan_usb_start, + .dev_free = pcan_usb_free, .dev_restart_async = pcan_usb_restart_async, .do_get_berr_counter = pcan_usb_get_berr_counter, }; -- 2.47.3