[PATCH] USB: fix race in kaweth disconnect

this patch from Herbert Xu fixes a race by moving termination of
the URBs into close() exclusively.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/usb/net/kaweth.c b/drivers/usb/net/kaweth.c
index 6bef1be6b36cce979ddeaef7131630d68e657f39..b5776518020f13dc0bfd680f2788900ecf3ede05 100644 (file)
--- a/drivers/usb/net/kaweth.c
+++ b/drivers/usb/net/kaweth.c
@@ -219,7 +219,6 @@ struct kaweth_device
 
        __u32 status;
        int end;
-       int removed;
        int suspend_lowmem_rx;
        int suspend_lowmem_ctrl;
        int linkstate;
@@ -699,6 +698,7 @@ static int kaweth_close(struct net_device *net)
 
        usb_kill_urb(kaweth->irq_urb);
        usb_kill_urb(kaweth->rx_urb);
+       usb_kill_urb(kaweth->tx_urb);
 
        flush_scheduled_work();
 
@@ -750,13 +750,6 @@ static int kaweth_start_xmit(struct sk_buff *skb, struct net_device *net)
 
        spin_lock(&kaweth->device_lock);
 
-       if (kaweth->removed) {
-       /* our device is undergoing disconnection - we bail out */
-               spin_unlock(&kaweth->device_lock);
-               dev_kfree_skb_irq(skb);
-               return 0;
-       }
-
        kaweth_async_set_rx_mode(kaweth);
        netif_stop_queue(net);
 
@@ -1136,10 +1129,6 @@ static void kaweth_disconnect(struct usb_interface *intf)
                return;
        }
        netdev = kaweth->net;
-       kaweth->removed = 1;
-       usb_kill_urb(kaweth->irq_urb);
-       usb_kill_urb(kaweth->rx_urb);
-       usb_kill_urb(kaweth->tx_urb);
 
        kaweth_dbg("Unregistering net device");
        unregister_netdev(netdev);