Re: [PATCH] USB: serial: oti6858: fix the teardown order in close

[Johan Hovold <johan@kernel.org>]

On Tue, Oct 27, 2026 at 03:31:26PM +0100, Greg Kroah-Hartman wrote:
> From: Josef Bacik <josef@toxicpanda.com>
> 
> The driver passes a baton around: the completion handler of the
> interrupt urb either resubmits the urb, submits the read urb or
> schedules one of the two delayed works, and the works and the bulk
> completion handlers submit the interrupt urb again.
> 
> oti6858_close() cancels the works first and kills the urbs afterwards.
> An interrupt urb that completes in between schedules a work again:
> 
> 	oti6858_close()
> 	  cancel_delayed_work_sync(setup)
> 	  cancel_delayed_work_sync(write)
> 				oti6858_read_int_callback()
> 				  schedule_delayed_work(setup)
> 	  usb_kill_urb(interrupt_in_urb)	/* not in flight */
> 				setup_line()
> 				  usb_submit_urb(interrupt_in_urb)
> 
> The port is now closed with the baton still going round. The next open
> fails because the interrupt urb is already submitted, and if the device
> is unplugged, oti6858_port_remove() frees the private data while a work
> may be pending or running.
>
> Poison the interrupt urb first: that waits for the handler and makes all
> further submissions fail, so nothing schedules the works any more. Then
> cancel the works, after which only the bulk urbs are left, kill those,
> and make the interrupt urb usable again for the next open. Don't print
> an error for the submissions that fail with -EPERM in this window, as
> oti6858_read_bulk_callback() already does.
> 
> Fixes: 49cdee0ed0fc ("USB: oti6858 usb-serial driver (in Nokia CA-42 cable)")
> Cc: stable <stable@kernel.org>
> Cc: Johan Hovold <johan@kernel.org>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> Johan, another llm-found patch, seems sane, but it's not exactly obvious
> to me if this is real or not?

Yes, this all looks good. I'll queue this one for 7.4. Thanks.

Johan