Re: [PATCH net v4] usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return()

[Simon Horman <horms@kernel.org>]

On Tue, Oct 20, 2026 at 06:29:09PM +0300, Ömer Mete Kaya wrote:
> On SMP, usbnet_skb_return() can observe EVENT_RX_PAUSED as set on CPU0
> while usbnet_resume_rx() clears the flag and drains rxq_pause on CPU1.
> The skb can then be queued after the drain has completed and remain
> stranded until the next MTU change or device stop.
> 
> Synchronize the EVENT_RX_PAUSED state transition and paused-queue
> dequeue operations with rxq_pause.lock, dropping the lock around each
> usbnet_skb_return() call to avoid lock inversion. In usbnet_skb_return()
> use a double-check pattern under rxq_pause.lock on the slow path,
> keeping the normal RX fast path lock-free. Use spin_lock_irqsave() to
> match the lockdep class shared with other sk_buff_head locks taken from
> hardirq context in defer_bh().
> 
> Discovered by Sashiko, not triggered, not runtime-tested.
> 
> Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
> Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
> 
> ---
> v4: Use spin_lock_irqsave()/spin_unlock_irqrestore() to match lockdep
>     class shared with other sk_buff_head locks taken from hardirq
>     context in defer_bh(); restore local_bh_disable()/local_bh_enable()
>     around drain loop to preserve BH context.

Reviewed-by: Simon Horman <horms@kernel.org>