From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from r3-21.sinamail.sina.com.cn (r3-21.sinamail.sina.com.cn [202.108.3.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E936750276 for ; Wed, 25 Feb 2026 04:58:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.108.3.21 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771995503; cv=none; b=pFPbHUUeZjMNmTpfw8Dh8t65leVamddiRtvH//0CAb76IaN1JWva+hpNmf6jXvl6yVA2yivJ6n/pZNfDAEMbKUG03EapzGPaKpaNLTKlNgGlsfpVcpO6M61SO3cdhRdX2xH2JC11ZvmMRY+WhD9jpVH+q3cQK7jAreU39wpAH04= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771995503; c=relaxed/simple; bh=GsBnZBzoOn9LZps/kXefDq5kj0TM0oGUJvJCSZtprZk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VKb2iszuakc5hdi2+7SAT7ZJNfA0I0/D1pzVgGv5ESzvkmYseiVeSfZEgMokZ36ERdTYY14bUMJhhxgqigMxwmBR+NVmb/5TyvkR7NCAP01foIRbHBHQLldr9dJD21Qrgb/9T8/DXUYR3mmjpEnd+BvYwgnH+Ey1aB7Q/vG+5Yw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=zczb6Wbj; arc=none smtp.client-ip=202.108.3.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="zczb6Wbj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1771995499; bh=A9PPuZK2UWsJVjvbpFAXQQruj4iNN1iI97s65OeXydQ=; h=From:Subject:Date:Message-ID; b=zczb6WbjLWdKmdLA+wENBMv9CpiIluAyrAn/0HSPOW4zVL35k+f2X+M0Qw35KQj+r 9d4SnSzrEQM9UOiZ8PG59NboYO/4uyD1OqYyX4TNrSQHnoj723M+JrS27ISmsuc/EV jIHq4tQAe4IeeV5WIoUhd2SkslG+GAPyHMu+M8lg= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([114.249.62.144]) by sina.com (10.54.253.33) with ESMTP id 699E8166000026E1; Wed, 25 Feb 2026 12:58:15 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 7532106685159 X-SMAIL-UIID: BA97CA3AA2E54C7C9352CDAC8D43F3BA-20260225-125815-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [usb?] BUG: sleeping function called from invalid context in usb_tx_block Date: Wed, 25 Feb 2026 12:58:05 +0800 Message-ID: <20260225045807.386-1-hdanton@sina.com> In-Reply-To: <699df457.050a0220.131eeb.0009.GAE@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit > Date: Tue, 24 Feb 2026 10:56:23 -0800 [thread overview] > Hello, > > syzbot found the following issue on: > > HEAD commit: 8bf22c33e7a1 Merge tag 'net-7.0-rc1' of git://git.kernel.o.. > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > console output: https://syzkaller.appspot.com/x/log.txt?x=127b9722580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=1ff39736314a9939 > dashboard link: https://syzkaller.appspot.com/bug?extid=74afbb6355826ffc2239 > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1561fffa580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1031795a580000 #syz test --- x/drivers/net/wireless/marvell/libertas/if_usb.h +++ y/drivers/net/wireless/marvell/libertas/if_usb.h @@ -44,7 +44,7 @@ struct bootcmdresp /* USB card description structure*/ struct if_usb_card { struct usb_device *udev; - uint32_t model; /* MODEL_* */ + uint32_t tx_in_flight, model; /* MODEL_* */ struct urb *rx_urb, *tx_urb; struct lbs_private *priv; --- x/drivers/net/wireless/marvell/libertas/if_usb.c +++ y/drivers/net/wireless/marvell/libertas/if_usb.c @@ -86,6 +86,7 @@ static void if_usb_write_bulk_callback(s { struct if_usb_card *cardp = (struct if_usb_card *) urb->context; + cardp->tx_in_flight--; /* handle the transmission complete validations */ if (urb->status == 0) { @@ -425,8 +426,11 @@ static int usb_tx_block(struct if_usb_ca ret = -ENODEV; goto tx_ret; } - - usb_kill_urb(cardp->tx_urb); + if (cardp->tx_in_flight++) { + cardp->tx_in_flight--; + ret = -EBUSY; + goto tx_ret; + } usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, usb_sndbulkpipe(cardp->udev, @@ -436,6 +440,7 @@ static int usb_tx_block(struct if_usb_ca cardp->tx_urb->transfer_flags |= URB_ZERO_PACKET; if ((ret = usb_submit_urb(cardp->tx_urb, GFP_ATOMIC))) { + cardp->tx_in_flight--; lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret); } else { lbs_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n"); --