A failed interrupt URB submission leaves NAPI enabled and EVENT_DEV_OPEN set. A subsequent open enables NAPI again, triggering BUG_ON() in napi_enable(). Clear EVENT_DEV_OPEN and disable NAPI on the submission error path. Reproduced using failslab on a Raspberry Pi 3 Model B+ (LAN7515). With the fix, the injected allocation failure returns -ENOMEM and a subsequent open succeeds. Verified connectivity with ping and SSH. Signed-off-by: Stefano Munari Reviewed-by: Nicolai Buchwitz --- v3: - Target net-next and drop the Fixes tag as requested by Andrew. v2: https://lore.kernel.org/netdev/20261020202614.30277-1-stefanomunari.sm@gmail.com - Move cleanup code to err_napi unwind label as suggested by Nicolai. - Add Nicolai's Reviewed-by tag. v1: https://lore.kernel.org/netdev/20261016000521.92868-1-stefanomunari.sm@gmail.com --- drivers/net/usb/lan78xx.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 181e8c087..d73002b2c 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -3497,17 +3497,20 @@ static int lan78xx_open(struct net_device *net) if (ret < 0) { netif_err(dev, ifup, dev->net, "intr submit %d\n", ret); - goto done; + goto err_napi; } } phylink_start(dev->phylink); - -done: mutex_unlock(&dev->dev_mutex); - if (ret < 0) - usb_autopm_put_interface(dev->intf); + return 0; + +err_napi: + clear_bit(EVENT_DEV_OPEN, &dev->flags); + napi_disable(&dev->napi); + mutex_unlock(&dev->dev_mutex); + usb_autopm_put_interface(dev->intf); return ret; } -- 2.55.0