Re: [PATCH net v3] usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return()

["Ömer Mete Kaya" <omermetekaya0@gmail.com>]

On 10/9/26 01:03, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] net: out-of-order packet delivery during RX resume
> --
> 
> commit 7148b0b2b0b945f31b2120d7f4cbc269acf91635
> Author: Ömer Mete Kaya <omermetekaya0@gmail.com>
> 
> usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return()
> 
> This commit addresses a race condition in usbnet_skb_return() by protecting
> the EVENT_RX_PAUSED flag check and enqueue operations with a double-check
> pattern under the rxq_pause lock. It also protects the clear_bit() operation
> in usbnet_resume_rx() under the same lock.
> 
>> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
>> index a19ecf718f36a..d1ec3ba1e10e6 100644
>> --- a/drivers/net/usb/usbnet.c
>> +++ b/drivers/net/usb/usbnet.c
> [ ... ]
>> @@ -700,15 +705,16 @@ void usbnet_resume_rx(struct usbnet *dev)
>>  	int num = 0;
>>  
>>  	local_bh_disable();
>> +	spin_lock(&dev->rxq_pause.lock);
>>  	clear_bit(EVENT_RX_PAUSED, &dev->flags);
>> -
>> +	spin_unlock(&dev->rxq_pause.lock);
> 
> [Severity: Medium]
> If a new packet arrives concurrently on another CPU via usbnet_skb_return(),
> could it observe EVENT_RX_PAUSED as false here?
> 
> If so, it would bypass the pause queue and immediately deliver the new SKB
> to the network stack via netif_rx().
> 
>>  	while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) {
>>  		usbnet_skb_return(dev, skb);
>>  		num++;
>>  	}
> 
> This seems like it would cause the newly arrived packet to be delivered before
> the older packets in the rxq_pause queue are fully drained by this while loop,
> leading to out-of-order delivery which can degrade TCP performance.
> 
The out-of-order delivery window between clear_bit() and the drain loop
is a pre-existing issue in the original code, not introduced by this
patch.