[PATCH] usbip: Stop tracking work context in event_handler()

[PATCH] usbip: Stop tracking work context in event_handler()

[John Ernberg]

From: Wiliam Puranen <wiliam.puranen@actia.se>

The work queue used by usbip is not pinned to a specific context.

When usbip_in_eh() evaluates if the call comes from the event handler
it doesn't actually check if the call comes from the event handler but
if the call comes from the same context as the event handler was first
called from.

This can result in "sticky" devices on the client side, due to the
teardown path in stub_disconnect() being lied to, and thus skipping
the teardown when it shouldn't, or vice versa.

Fixes: bb7871ad99ea ("usbip: event handler as one thread")
Cc: stable@vger.kernel.org # v4.6+
Assisted-by: claude:opus-5
Signed-off-by: Wiliam Puranen <wiliam.puranen@actia.se>
Signed-off-by: John Ernberg <john.ernberg@actia.se>
---
 drivers/usb/usbip/stub_dev.c     |  2 +-
 drivers/usb/usbip/usbip_common.h |  2 +-
 drivers/usb/usbip/usbip_event.c  | 10 ++--------
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index abfa11d6bde7..407ac55d85c5 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -474,7 +474,7 @@ static void stub_disconnect(struct usb_device *udev)
 	}
 
 	/* If usb reset is called from event handler */
-	if (usbip_in_eh(current))
+	if (usbip_in_eh())
 		return;
 
 	/* we already have busid_priv, just lock busid_lock */
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index be4c5e65a7f8..2c91187e6469 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -321,7 +321,7 @@ int usbip_start_eh(struct usbip_device *ud);
 void usbip_stop_eh(struct usbip_device *ud);
 void usbip_event_add(struct usbip_device *ud, unsigned long event);
 int usbip_event_happened(struct usbip_device *ud);
-int usbip_in_eh(struct task_struct *task);
+int usbip_in_eh(void);
 
 static inline int interface_to_busnum(struct usb_interface *interface)
 {
diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 0e00c2d000f8..695af652c512 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -57,16 +57,10 @@ static struct usbip_device *get_event(void)
 	return ud;
 }
 
-static struct task_struct *worker_context;
-
 static void event_handler(struct work_struct *work)
 {
 	struct usbip_device *ud;
 
-	if (worker_context == NULL) {
-		worker_context = current;
-	}
-
 	while ((ud = get_event()) != NULL) {
 		usbip_dbg_eh("pending event %lx\n", ud->event);
 
@@ -186,9 +180,9 @@ int usbip_event_happened(struct usbip_device *ud)
 }
 EXPORT_SYMBOL_GPL(usbip_event_happened);
 
-int usbip_in_eh(struct task_struct *task)
+int usbip_in_eh(void)
 {
-	if (task == worker_context)
+	if (current_work() == &usbip_work)
 		return 1;
 
 	return 0;
-- 
2.53.0

Re: [PATCH] usbip: Stop tracking work context in event_handler()

[Michael Grzeschik]

Hi John,

On Mon, Aug 03, 2026 at 10:43:58AM +0000, John Ernberg wrote:
> From: Wiliam Puranen <wiliam.puranen@actia.se>
> 
> The work queue used by usbip is not pinned to a specific context.
> 
> When usbip_in_eh() evaluates if the call comes from the event handler
> it doesn't actually check if the call comes from the event handler but
> if the call comes from the same context as the event handler was first
> called from.
> 
> This can result in "sticky" devices on the client side, due to the
> teardown path in stub_disconnect() being lied to, and thus skipping
> the teardown when it shouldn't, or vice versa.
> 
> Fixes: bb7871ad99ea ("usbip: event handler as one thread")
> Cc: stable@vger.kernel.org # v4.6+
> Assisted-by: claude:opus-5
> Signed-off-by: Wiliam Puranen <wiliam.puranen@actia.se>
> Signed-off-by: John Ernberg <john.ernberg@actia.se>

Just as I stated in my other mail [1]. I just did send a near copy of
the change without knowing of this mail. But this one is the patch to
be taken.

Fixes: bb7871ad99ea ("usbip: event handler as one thread")
Reviewed-by: Michael Grzeschik <grzeschik@puzzle.ch>

[1]: https://lore.kernel.org/linux-usb/427d908d-1fa2-442c-ac91-b3e925e5c7bb@actia.se/T/#m2d50ad8abda5dc92fe6d8690edc0cab58983ab74

Thanks
Michael