[PATCH] usb-storage: ene_ub6250: serialize card type probe with scan work

[PATCH] usb-storage: ene_ub6250: serialize card type probe with scan work

[liuqi]

usb_stor_probe2() starts the usb-storage infrastructure and schedules
the delayed scan work. The probe then calls ene_get_card_type(), which
sends a command through ene_send_scsi_cmd() and the usb-storage bulk
transfer helpers. These helpers use us->current_urb.

The delayed scan work also uses us->current_urb when issuing GET_MAX_LUN
through usb_stor_Bulk_max_lun(). The scan path is serialized with
us->dev_mutex, but the post-usb_stor_probe2() ENE card-type probe is not.

If the ENE card-type command is still in flight when the delayed scan
work runs, the scan work can try to submit the same URB again, and
usb_submit_urb() warns that the URB is already active.

Serialize ene_get_card_type() with us->dev_mutex, matching the locking
used by the scan path.

Reported-by: syzbot+22ea20ef3afb6785b122@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=22ea20ef3afb6785b122
Signed-off-by: liuqi <liuqi@longcheer.com>
---
 drivers/usb/storage/ene_ub6250.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 2cffc559a..13b332d1d 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -2358,7 +2358,9 @@ static int ene_ub6250_probe(struct usb_interface *intf,
 		return result;
 
 	/* probe card type */
+	mutex_lock(&us->dev_mutex);
 	result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
+	mutex_unlock(&us->dev_mutex);
 	if (result != USB_STOR_XFER_GOOD) {
 		usb_stor_disconnect(intf);
 		return USB_STOR_TRANSPORT_ERROR;
-- 
2.43.0

Re: [PATCH] usb-storage: ene_ub6250: serialize card type probe with scan work

[Greg KH]

On Fri, Aug 21, 2026 at 01:53:58PM +0800, liuqi wrote:
> usb_stor_probe2() starts the usb-storage infrastructure and schedules
> the delayed scan work. The probe then calls ene_get_card_type(), which
> sends a command through ene_send_scsi_cmd() and the usb-storage bulk
> transfer helpers. These helpers use us->current_urb.
> 
> The delayed scan work also uses us->current_urb when issuing GET_MAX_LUN
> through usb_stor_Bulk_max_lun(). The scan path is serialized with
> us->dev_mutex, but the post-usb_stor_probe2() ENE card-type probe is not.
> 
> If the ENE card-type command is still in flight when the delayed scan
> work runs, the scan work can try to submit the same URB again, and
> usb_submit_urb() warns that the URB is already active.
> 
> Serialize ene_get_card_type() with us->dev_mutex, matching the locking
> used by the scan path.
> 
> Reported-by: syzbot+22ea20ef3afb6785b122@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=22ea20ef3afb6785b122
> Signed-off-by: liuqi <liuqi@longcheer.com>

Did you forget an Assisted-by: tag for this?

How was this tested?

And as before, we need a real name.

thanks,

greg k-h