Re: [PATCH 2/6] usbip: vhci_hcd: complete unsent URBs locally in vhci_urb_dequeue()

[sashiko-bot@kernel.org]

> When an URB is enqueued via vhci_urb_enqueue(), its vhci_priv entry is
> placed on vdev->priv_tx until vhci_tx_loop() moves it to vdev->priv_rx
> in dequeue_from_priv_tx() and sends USBIP_CMD_SUBMIT.
> 
> If vhci_urb_dequeue() is called while the URB is still on vdev->priv_tx
> and vdev->ud.tcp_socket is non-NULL, vhci_urb_dequeue() currently sets
> urb->unlinked and queues a vhci_unlink entry on vdev->unlink_tx without
> removing the URB from vdev->priv_tx. This causes two bugs:
> 
> 1. If vhci_tx_loop() has already exited after an earlier send error or
>    been stopped during connection shutdown before tcp_socket is cleared,
>    the URB remains on vdev->priv_tx. When vhci_device_unlink_cleanup()
>    later runs pickup_urb_and_free_priv(), which only searches
>    vdev->priv_rx, the vhci_unlink entry is freed while the URB remains
>    linked on ep->urb_list with urb->unlinked set. Subsequent calls to
> [ ... ]
> Fixes: 258c81b341c8 ("usbip: give back URBs for unsent unlink requests during cleanup")
> Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Gemini
> Signed-off-by: Raul E Rangel <rrangel@chromium.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021150704.3129446-1-rrangel@chromium.org?part=2