From nobody Thu Oct 2 00:49:29 2025 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA0B03054F6 for ; Wed, 24 Sep 2025 13:44:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758721450; cv=none; b=aFn7qWodDc8LoQtEQO6dsEPQUY0cc9MfED+M+r2sWY5XMGNQqNfxmSBZ04ywUmiZBsm4sH9U2x7Wwzcw/WtWYEG0g4yvxUGwieJy28Yafjqew70xXyYN4vMKlHUdJuJrsiTQgcAPgA9XT0X4icq/sP1HWm9AHASuNc7GtWfGedc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758721450; c=relaxed/simple; bh=4wLHZd33H8ehWtqgfz/soUMTx6YkXPchLkux0RhTQvY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eKjIbpWOPWuecaqmwdcHv/FEVvxrMLrHO717ziVoa/GvJOmhrHZNaZYu3KEDi43D3JGmKupQDLbDiDCLLLMQy4UXqffASqh1FSaNbSJxaEHxS9IHkXCQIapkqra+sInZjvRHMuUuOre1pqBZ5vUgixGfH+sFZv0ePCQb53VOzk8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kkxO9eUm; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kkxO9eUm" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-77f358c7b8fso751032b3a.1 for ; Wed, 24 Sep 2025 06:44:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1758721448; x=1759326248; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Y4ERu7wVLsz3ac7e7KRVwhrDHIHWN9PyFzkY9Sy5iLE=; b=kkxO9eUm2Ku2Qjpp8lbdcYaAvBnJIGyLS9CDBI7UA7+uOg0z3ro/1pVjObvJPpQ50r D5MwIV1FJaP8A03X+KdEksfQdr+jS24wSqKTw/yoaUc/WXFxG7tMnfSTfgYkSO8JQC+W ACKJMKomxTnx2mHCvGeTF2x4txyI+gllDSvZKN+bea1LHf/RKjLeGeWVn0+eifiH5ePK Z+CHBIJk3aSJEQUpC6rLrh4qXQ5etSErvpiRGfW94e1aMAcZUSUIlD0WAIKUd6xxxZU0 I1chd7MmgkmvAceYl2pO3pQFC+DnAfncgDvWREXUwpGbX/7Ttu14lvp/0xoXRCstZzPm O/ZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758721448; x=1759326248; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Y4ERu7wVLsz3ac7e7KRVwhrDHIHWN9PyFzkY9Sy5iLE=; b=kvvX32t/BlgLTFXDDbJX7sZ5Ty4p+8lpNSezUQYMkr6YZ/Gm2BxA7tE0O1DsOqm8PA 4g6WLHrsx/Ml7Gwx38mGImW1M/h0hf1OnXiugs3H1+T7p54TSufY9R7TR3CHLUoITWm/ 2Db5qoTD39ewLMxK6U6HBwUl8T8yy4mZXSM2eaLuaOsZlqxnJ2K9olhjNcKOsSPqOrTh 4qP8t+rUPmloeL24l5VhEamRvdu2Geak+bL2kLf1R8YYx9vieBhyWJ7Mrpj0LqVdCbWE e16m2jHaZk4bAg85y+B0yY0TWGu+ChNnAAugL6D6QvNUWklHWukXTZDr+U/q/I+NYq8z yKeA== X-Forwarded-Encrypted: i=1; AJvYcCUrvJs42YqsV/c8goj+WysWHx8vLAF62jYBoU559njIy7fybOk2WwyTC2ezruH55z/99/zINK6Mbigynk8=@vger.kernel.org X-Gm-Message-State: AOJu0YxPlZ/M11Xrw2Ay3h+iA01Ry2YSnG5VcvWk8jOXiUQum7XX6yH3 vk8bR0HGnr7vv1VTsEApa6/02f69OXy1xv2nR5FzLMi18+RqUJX2QTqh X-Gm-Gg: ASbGncsg4xI9+VrTuH6f/Y7Z6Y4hqLuCbar7ttColLVEEs2ys1AHCEnsxP6EnjtYeFX Tov5cmtlQ+ohfZD5/QGval8EUdmW4Nxo48waCtmoRLAUNWkH+0qhRfHPKdnRHiDApnFkvDxQ3re MeX4J2SgtXNoeKX7zPVMkhUiTghWDcQOkvnhPvgfQuZKc4jDcADFFLmZ7OOY6xILUs0Sm61K4AP uoytwsuw5Fru1bJMVWale3hekj9MnkUcIrfTMwh7DGF8F+jzp68EB3humjAlZzudsGcUxtMPfBB gTCXYzheJsgyS78T591XMww4tJi8Ta3KzaEl/FxgoJM0Qlq85dp6vqalBFRz3eoSSEN5jpMFmdy 1kOUe4hh/53mQYtZc6xZUmw3/B7o1PSvxZyjjAd69S+GcqyCk1B/EaD59hET3hAqVVXCTwEzc/8 qkbnCzy8mBXh1N X-Google-Smtp-Source: AGHT+IE/4+SM58UU/wqTR/yIT31R0oJ4u37QZEN5c3JMJpyuvVeiCRq+ypyCOhvw3JyqJDdBS271KQ== X-Received: by 2002:a17:90b:3fce:b0:32e:dcc6:cd3f with SMTP id 98e67ed59e1d1-3341bfeffbdmr2681721a91.14.1758721447987; Wed, 24 Sep 2025 06:44:07 -0700 (PDT) Received: from debian.domain.name ([223.181.105.88]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3341be45620sm2486219a91.29.2025.09.24.06.44.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Sep 2025 06:44:06 -0700 (PDT) From: I Viswanath To: kuba@kernel.org, michal.pecio@gmail.com, edumazet@google.com, andrew+netdev@lunn.ch, davem@davemloft.net, petkan@nucleusys.com, pabeni@redhat.com Cc: linux-usb@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, linux-kernel-mentees@lists.linux.dev, david.hunter.linux@gmail.com, I Viswanath , syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com Subject: [PATCH net v3] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast Date: Wed, 24 Sep 2025 19:13:50 +0530 Message-ID: <20250924134350.264597-1-viswanathiyyappan@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be=20 calling netif_stop_queue and notif_start_queue as these handle=20 TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.c= om Closes: https://syzkaller.appspot.com/bug?extid=3D78cae3f37c62ad092caa Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Michal Pecio Signed-off-by: I Viswanath --- v1:=20 Link: https://lore.kernel.org/netdev/20250920045059.48400-1-viswanathiyyapp= an@gmail.com/ =20 v2: - Add explanation why netif_stop_queue/netif_wake_queue can be safely remov= ed - Add the net prefix to the patch, designating it to the net tree Link: https://lore.kernel.org/netdev/20250920181852.18164-1-viswanathiyyapp= an@gmail.com/ =20 v3: - Simplified the event sequence that lead to the warning - Added Tested-by tag drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index ddff6f19ff98..92add3daadbb 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *ne= tdev) rtl8150_t *dev =3D netdev_priv(netdev); u16 rx_creg =3D 0x9e; =20 - netif_stop_queue(netdev); if (netdev->flags & IFF_PROMISC) { rx_creg |=3D 0x0001; dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); @@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *ne= tdev) rx_creg &=3D 0x00fc; } async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); - netif_wake_queue(netdev); } =20 static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, --=20 2.47.3