Re: [PATCH 3/6] usbip: vhci_hcd: stop enqueue and drain all pending URBs on disconnect

[sashiko-bot@kernel.org]

> Even with vhci_urb_dequeue() completing unsent URBs locally when
> unlinked, several races in vhci_shutdown_connection() allow URBs to be
> enqueued after shutdown begins or remain stranded on vdev->priv_tx and
> vdev->priv_rx across disconnect and port reset:
> 
> 1. vhci_urb_enqueue() only rejects URBs when vdev->ud.status is
>    VDEV_ST_NULL or VDEV_ST_ERROR. Because ud.status remains VDEV_ST_USED
>    after USBIP_EH_SHUTDOWN is set and until vhci_device_reset() runs
>    after vhci_shutdown_connection(), vhci_urb_enqueue() continues
>    accepting new URBs onto vdev->priv_tx even after tcp_tx has stopped.
> 
> 2. vhci_shutdown_connection() clears vdev->ud.tcp_socket without holding
>    vhci->lock or vdev->ud.lock, racing with vhci_urb_enqueue() and
>    vhci_urb_dequeue().
> 
> [ ... ]
> Fixes: 258c81b341c8 ("usbip: give back URBs for unsent unlink requests during cleanup")
> Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Gemini
> Signed-off-by: Raul E Rangel <rrangel@chromium.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021150704.3129446-1-rrangel@chromium.org?part=3