On an error path inside the hso_create_net_device function of the hso driver, hso_free_net_device gets called. This causes potentially a negative reference count in the net device if register_netdev has not been called yet as hso_free_net_device calls unregister_netdev regardless. I think the driver should distinguish these cases and call unregister_netdev only if register_netdev has been called.
Reported-by: Tuba Yavuz <t...@ece.ufl.edu> Signed-off-by: Tuba Yavuz <t...@ece.ufl.edu> --- --- drivers/net/usb/hso.c.orig 2019-01-27 14:45:58.232683119 -0500 +++ drivers/net/usb/hso.c 2019-01-27 14:47:43.592683629 -0500 @@ -2377,7 +2377,7 @@ static void hso_free_net_device(struct h remove_net_device(hso_net->parent); - if (hso_net->net) + if (hso_net->net && hso_net->net->reg_state == NETREG_REGISTERED) unregister_netdev(hso_net->net); /* start freeing */
