On 10.11.26 05:30, Myeonghun Pak wrote: Hi, > Kill the tasklet again after unlink_all_urbs() has waited for all > completion handlers. tasklet_kill() drains any late tasklet and prevents > self-rescheduling; disabled endpoints prevent it from leaving an RX > URB in flight. Keep the first kill to stop an existing reschedule loop > before unregister_netdev(). > > Found by a static analysis tool under development. Good catch; nice tool. But the fix is not correct. > Fixes: eff674a514bd ("USB: rtl8150_disconnect() needs tasklet_kill()") > Cc: stable@vger.kernel.org > Co-developed-by: Ijae Kim > Signed-off-by: Ijae Kim > Signed-off-by: Myeonghun Pak > > --- > > drivers/net/usb/rtl8150.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c > index d51e43170e03..98c36c377956 100644 > --- a/drivers/net/usb/rtl8150.c > +++ b/drivers/net/usb/rtl8150.c > @@ -971,6 +971,8 @@ static void rtl8150_disconnect(struct usb_interface *intf) > tasklet_kill(&dev->tl); > unregister_netdev(dev->netdev); > unlink_all_urbs(dev); > + /* A completion may have scheduled it after the first kill. */ > + tasklet_kill(&dev->tl); The tasklet, however, can also submit the URB again, which in turn can submit the tasklet and so on. There is an unavoidable window in that sequence, as tasklet_kill() will kill the tasklet, but it may have run in the window. Hence you need to also, in addition to your patch, actually prevent the resubmission of the URBs. The attached fix will do so. How do we do this? Shall I submit? Do you want a joint submission? Regards Oliver