[PATCH net] net: usb: lan78xx: fix error handling in lan78xx_open()

[PATCH net] net: usb: lan78xx: fix error handling in lan78xx_open()

[Stefano Munari]

A failed interrupt URB submission leaves NAPI enabled and EVENT_DEV_OPEN
set. A subsequent open enables NAPI again, triggering BUG_ON() in
napi_enable().

Clear EVENT_DEV_OPEN and disable NAPI on the submission error path.

Reproduced using failslab on a Raspberry Pi 3 Model B+ (LAN7515).
With the fix, the injected allocation failure returns -ENOMEM and a
subsequent open succeeds. Verified connectivity with ping and SSH.

Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
Signed-off-by: Stefano Munari <stefanomunari.sm@gmail.com>
---
 drivers/net/usb/lan78xx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5655941f1478..6a95934bb3d3 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3484,6 +3484,8 @@ static int lan78xx_open(struct net_device *net)
 		if (ret < 0) {
 			netif_err(dev, ifup, dev->net,
 				  "intr submit %d\n", ret);
+			clear_bit(EVENT_DEV_OPEN, &dev->flags);
+			napi_disable(&dev->napi);
 			goto done;
 		}
 	}
-- 
2.55.0

Re: [PATCH net] net: usb: lan78xx: fix error handling in lan78xx_open()

[Nicolai Buchwitz]

Hi Stefano

On 16.10.2026 02:05, Stefano Munari wrote:
> A failed interrupt URB submission leaves NAPI enabled and 
> EVENT_DEV_OPEN
> set. A subsequent open enables NAPI again, triggering BUG_ON() in
> napi_enable().
> 
> Clear EVENT_DEV_OPEN and disable NAPI on the submission error path.
> 
> Reproduced using failslab on a Raspberry Pi 3 Model B+ (LAN7515).
> With the fix, the injected allocation failure returns -ENOMEM and a
> subsequent open succeeds. Verified connectivity with ping and SSH.
> 
> Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for 
> improved PHY and MAC management")
> Signed-off-by: Stefano Munari <stefanomunari.sm@gmail.com>
> ---
>  drivers/net/usb/lan78xx.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
> index 5655941f1478..6a95934bb3d3 100644
> --- a/drivers/net/usb/lan78xx.c
> +++ b/drivers/net/usb/lan78xx.c
> @@ -3484,6 +3484,8 @@ static int lan78xx_open(struct net_device *net)
>  		if (ret < 0) {
>  			netif_err(dev, ifup, dev->net,
>  				  "intr submit %d\n", ret);
> +			clear_bit(EVENT_DEV_OPEN, &dev->flags);
> +			napi_disable(&dev->napi);
>  			goto done;
>  		}
>  	}

Looks correct to me. Maybe move the cleanup into an unwind label, so
the next error path added after napi_enable() doesn't miss it?

                 if (ret < 0) {
                         netif_err(dev, ifup, dev->net,
                                   "intr submit %d\n", ret);
                         goto err_napi;
                 }
         }

         phylink_start(dev->phylink);
         mutex_unlock(&dev->dev_mutex);

         return 0;

err_napi:
         clear_bit(EVENT_DEV_OPEN, &dev->flags);
         napi_disable(&dev->napi);
         mutex_unlock(&dev->dev_mutex);
         usb_autopm_put_interface(dev->intf);

         return ret;

Either way:

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai