Re: [PATCH 0/6] usbip: vhci_hcd: fix URB giveback leaks and disconnect races

[Shuah Khan <skhan@linuxfoundation.org>]

On 10/21/26 09:06, Raul E Rangel wrote:
> This series fixes a set of URB lifecycle, locking, and disconnect
> teardown bugs in drivers/usb/usbip/vhci_hcd that can orphan pending URBs
> and wedge usb_kill_urb() and usb_hub_wq in uninterruptible D state when
> a virtual USB port disconnects under concurrent transfer/unlink load.
> 
> Patch breakdown:
>    1. Protect urb->hcpriv accesses in vhci_urb_dequeue() with
>       vdev->priv_lock inside vhci->lock (matching vhci_urb_enqueue() and
>       the cleanup helpers), and add a !portnum || portnum > VHCI_HC_PORTS
>       bounds guard to both vhci_urb_enqueue() and vhci_urb_dequeue().
>    2. Track whether an URB has been moved from vdev->priv_tx to
>       vdev->priv_rx via priv->submitted under vdev->priv_lock, and
>       complete unsent (!priv->submitted) URBs locally in
>       vhci_urb_dequeue() instead of queuing a CMD_UNLINK PDU. This
>       prevents vhci_device_unlink_cleanup() from freeing the unlink entry
>       and orphaning an unsent URB on priv_tx, and prevents CMD_UNLINK
>       from being transmitted before CMD_SUBMIT on an active connection.
>    3. Clear vdev->ud.tcp_socket under vhci->lock and vdev->ud.lock in
>       vhci_shutdown_connection(), reject vhci_urb_enqueue() once
>       USBIP_EH_SHUTDOWN is set or tcp_socket is NULL, and drain all
>       remaining URBs on vdev->priv_tx and vdev->priv_rx in
>       vhci_device_unlink_cleanup().
>    4. Move the URB_DMA_MAP_SG clearing from vhci_recv_ret_submit() into
>       pickup_urb_and_free_priv() and also clear URB_DMA_MAP_SG in
>       vhci_urb_dequeue() and vhci_cleanup_priv_list() so USB core does
>       not call dma_unmap_sg() on unmapped scatterlists on any giveback
>       path.
>    5. Allocate struct vhci_priv with mem_flags before acquiring spinlocks
>       in vhci_urb_enqueue(), and return 0 (with VDEV_EVENT_ERROR_MALLOC
>       triggered) if struct vhci_unlink allocation fails in
>       vhci_urb_dequeue() after usb_hcd_check_unlink_urb() has already
>       marked urb->unlinked.
>    6. Serialize vdev->udev clearing in vhci_device_reset() under
>       vhci->lock and ud->lock (dropping old usb_device and socket
>       references outside the spinlocks in both vhci_device_reset() and
>       vhci_urb_enqueue()), and reject URBs from a stale usb_device
>       (including address-0 requests from an already-registered
>       usb_device undergoing USBDEVFS_RESET) if the same rhport is
>       re-attached before usb_hub_wq finishes disconnecting the old
>       device.

What problems does this series fix? Do you have reproducers for these?

thanks,
-- Shuah