From: Xu Rao ipheth_open() submits the RX URB, and a successful RX completion resubmits it from ipheth_rcvbulk_callback(). ipheth_close() stops the netdev queue and disables the carrier work, but leaves the RX URB running. After an administrative link down, an already submitted RX URB can therefore complete, pass received packets to the networking stack, and submit itself again even though the interface has been stopped. Stop the RX URB from ndo_stop. Do not kill the TX URB: packets in a successfully submitted TX URB have already been accounted as transmitted, so let an in-flight TX complete normally after the queue has been stopped. usb_kill_urb() waits for a pending RX completion to finish and prevents the completion handler from successfully resubmitting the URB. Fixes: a19259c3d589 ("drivers/net/usb: Add new driver ipheth") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao --- v2: - Kill only the RX URB and leave an in-flight TX URB to complete normally, as pointed out by Oliver Neukum. drivers/net/usb/ipheth.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 2b490114d232..6b90fe1e0e38 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -505,6 +505,7 @@ static int ipheth_close(struct net_device *net) * it, so that such a schedule_delayed_work() is a no-op. */ disable_delayed_work_sync(&dev->carrier_work); + usb_kill_urb(dev->rx_urb); return 0; } -- 2.50.1