Re: [PATCH v3] usb: core: Solve race condition in anchor cleanup functions

[Oliver Neukum <oneukum@suse.de>]

Am Donnerstag, den 30.07.2020, 11:23 +0300 schrieb
eli.billauer@gmail.com:
> From: Eli Billauer <eli.billauer@gmail.com>
> 

Hi,

> The additional do-while loop relies on the new usb_anchor_safe_empty()
> function, which is like usb_anchor_check_wakeup(), only the former takes
> the anchor's lock before checking. Both functions return true iff the
> anchor list is empty, and there is no __usb_hcd_giveback_urb() in the
> system that is in the middle of the unanchor-before-complete phase.
> The @suspend_wakeups member of struct usb_anchor is used for this purpose,
> which was introduced to solve another problem which the same race
> condition causes, in commit 6ec4147e7bdb ("usb-anchor: Delay
> usb_wait_anchor_empty_timeout wake up till completion is done").
> 

I think you can partially heed Alan's suggestion. The test takes
a lock you have just dropped. You need to drop it before you
call usb_kill_urb(), but the drop before the test is redundant.

	Regards
		Oliver