{"api_version":"1","generated_at":"2026-11-11T16:15:38+00:00","cve":"CVE-2022-50220","urls":{"html":"https://cve.report/CVE-2022-50220","api":"https://cve.report/api/cve/CVE-2022-50220.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-50220","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-50220"},"summary":{"title":"usbnet: Fix linkwatch use-after-free on disconnect","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Fix linkwatch use-after-free on disconnect\n\nusbnet uses the work usbnet_deferred_kevent() to perform tasks which may\nsleep.  On disconnect, completion of the work was originally awaited in\n->ndo_stop().  But in 2003, that was moved to ->disconnect() by historic\ncommit \"[PATCH] USB: usbnet, prevent exotic rtnl deadlock\":\n\n  https://git.kernel.org/tglx/history/c/0f138bbfd83c\n\nThe change was made because back then, the kernel's workqueue\nimplementation did not allow waiting for a single work.  One had to wait\nfor completion of *all* work by calling flush_scheduled_work(), and that\ncould deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex\nheld in ->ndo_stop().\n\nThe commit solved one problem but created another:  It causes a\nuse-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,\nax88179_178a.c, ch9200.c and smsc75xx.c:\n\n* If the drivers receive a link change interrupt immediately before\n  disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)\n  ->status() callback and schedule usbnet_deferred_kevent().\n* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback,\n  which calls netif_carrier_{on,off}().\n* That in turn schedules the work linkwatch_event().\n\nBecause usbnet_deferred_kevent() is awaited after unregister_netdev(),\nnetif_carrier_{on,off}() may operate on an unregistered netdev and\nlinkwatch_event() may run after free_netdev(), causing a use-after-free.\n\nIn 2010, usbnet was changed to only wait for a single instance of\nusbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf\n(\"drivers/net: don't use flush_scheduled_work()\").\n\nUnfortunately the commit neglected to move the wait back to\n->ndo_stop().  Rectify that omission at long last.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-06-18 11:15:52","updated_at":"2026-11-05 20:17:27"},"problem_types":["CWE-416"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3","name":"https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f","name":"https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7","name":"https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e","name":"https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74","name":"https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4","name":"https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f","name":"https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4","name":"https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309","name":"https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-50220","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50220","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 d2d6b530d89b0a912148018027386aa049f0a309 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 e2a521a7dcc463c5017b4426ca0804e151faeff7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 7f77dcbc030c2faa6d8e8a594985eeb34018409e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 8b4588b8b00b299be16a35be67b331d8fdba03f3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 135199a2edd459d2b123144efcd7f9bcd95128e4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 635fd8953e4309b54ca6a81bed1d4a87668694f4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 db3b738ae5f726204876f4303c49cfdf4311403f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 23f333a2bfafba80339315b724808982a9de57d9 a69e617e533edddf3fa3123149900f36e0a6dc74 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.38","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.38 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.9.326 4.9.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14.291 4.14.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.256 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.211 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.137 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.61 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.18.18 5.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.19.2 5.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.0 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"50220","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2022-50220","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:07:05.736067Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T20:10:29.354Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/usbnet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d2d6b530d89b0a912148018027386aa049f0a309","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"e2a521a7dcc463c5017b4426ca0804e151faeff7","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"7f77dcbc030c2faa6d8e8a594985eeb34018409e","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"8b4588b8b00b299be16a35be67b331d8fdba03f3","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"135199a2edd459d2b123144efcd7f9bcd95128e4","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"635fd8953e4309b54ca6a81bed1d4a87668694f4","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"db3b738ae5f726204876f4303c49cfdf4311403f","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"},{"lessThan":"a69e617e533edddf3fa3123149900f36e0a6dc74","status":"affected","version":"23f333a2bfafba80339315b724808982a9de57d9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/usbnet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.326","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.291","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.256","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.211","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.137","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.61","versionType":"semver"},{"lessThanOrEqual":"5.18.*","status":"unaffected","version":"5.18.18","versionType":"semver"},{"lessThanOrEqual":"5.19.*","status":"unaffected","version":"5.19.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.0","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.326","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.14.291","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.256","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.211","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.137","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.61","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.18","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.19.2","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0","versionStartIncluding":"2.6.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Fix linkwatch use-after-free on disconnect\n\nusbnet uses the work usbnet_deferred_kevent() to perform tasks which may\nsleep.  On disconnect, completion of the work was originally awaited in\n->ndo_stop().  But in 2003, that was moved to ->disconnect() by historic\ncommit \"[PATCH] USB: usbnet, prevent exotic rtnl deadlock\":\n\n  https://git.kernel.org/tglx/history/c/0f138bbfd83c\n\nThe change was made because back then, the kernel's workqueue\nimplementation did not allow waiting for a single work.  One had to wait\nfor completion of *all* work by calling flush_scheduled_work(), and that\ncould deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex\nheld in ->ndo_stop().\n\nThe commit solved one problem but created another:  It causes a\nuse-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,\nax88179_178a.c, ch9200.c and smsc75xx.c:\n\n* If the drivers receive a link change interrupt immediately before\n  disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)\n  ->status() callback and schedule usbnet_deferred_kevent().\n* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback,\n  which calls netif_carrier_{on,off}().\n* That in turn schedules the work linkwatch_event().\n\nBecause usbnet_deferred_kevent() is awaited after unregister_netdev(),\nnetif_carrier_{on,off}() may operate on an unregistered netdev and\nlinkwatch_event() may run after free_netdev(), causing a use-after-free.\n\nIn 2010, usbnet was changed to only wait for a single instance of\nusbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf\n(\"drivers/net: don't use flush_scheduled_work()\").\n\nUnfortunately the commit neglected to move the wait back to\n->ndo_stop().  Rectify that omission at long last."}],"providerMetadata":{"dateUpdated":"2026-05-11T19:15:07.972Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309"},{"url":"https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7"},{"url":"https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e"},{"url":"https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3"},{"url":"https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4"},{"url":"https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4"},{"url":"https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f"},{"url":"https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f"},{"url":"https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74"}],"title":"usbnet: Fix linkwatch use-after-free on disconnect","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2022-50220","datePublished":"2025-06-18T11:03:55.461Z","dateReserved":"2025-06-18T10:57:27.430Z","dateUpdated":"2026-11-05T20:10:29.354Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-06-18 11:15:52","lastModifiedDate":"2026-11-05 20:17:27","problem_types":["CWE-416"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-05T20:07:05.736067Z","id":"CVE-2022-50220","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.38","versionEndExcluding":"4.9.326","matchCriteriaId":"4197D395-7363-4526-9658-190ED07AA35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"4.14.291","matchCriteriaId":"3BBC7E43-6161-4F21-977C-5BB7792C6C94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"4.19.256","matchCriteriaId":"6C47CDE3-B039-4AE5-B8E4-1DC820E473FF"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.211","matchCriteriaId":"B1C63D19-C08C-4308-A848-B2523C9275BD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.137","matchCriteriaId":"C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.61","matchCriteriaId":"51861563-7F40-460F-82CD-2D3FBDAD6618"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"5.18.18","matchCriteriaId":"5B42E453-8837-49D0-A5EF-03F818A6DC11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"5.19.2","matchCriteriaId":"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"50220","Ordinal":"1","Title":"usbnet: Fix linkwatch use-after-free on disconnect","CVE":"CVE-2022-50220","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"50220","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Fix linkwatch use-after-free on disconnect\n\nusbnet uses the work usbnet_deferred_kevent() to perform tasks which may\nsleep.  On disconnect, completion of the work was originally awaited in\n->ndo_stop().  But in 2003, that was moved to ->disconnect() by historic\ncommit \"[PATCH] USB: usbnet, prevent exotic rtnl deadlock\":\n\n  https://git.kernel.org/tglx/history/c/0f138bbfd83c\n\nThe change was made because back then, the kernel's workqueue\nimplementation did not allow waiting for a single work.  One had to wait\nfor completion of *all* work by calling flush_scheduled_work(), and that\ncould deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex\nheld in ->ndo_stop().\n\nThe commit solved one problem but created another:  It causes a\nuse-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,\nax88179_178a.c, ch9200.c and smsc75xx.c:\n\n* If the drivers receive a link change interrupt immediately before\n  disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)\n  ->status() callback and schedule usbnet_deferred_kevent().\n* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback,\n  which calls netif_carrier_{on,off}().\n* That in turn schedules the work linkwatch_event().\n\nBecause usbnet_deferred_kevent() is awaited after unregister_netdev(),\nnetif_carrier_{on,off}() may operate on an unregistered netdev and\nlinkwatch_event() may run after free_netdev(), causing a use-after-free.\n\nIn 2010, usbnet was changed to only wait for a single instance of\nusbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf\n(\"drivers/net: don't use flush_scheduled_work()\").\n\nUnfortunately the commit neglected to move the wait back to\n->ndo_stop().  Rectify that omission at long last.","Type":"Description","Title":"usbnet: Fix linkwatch use-after-free on disconnect"}]}}}