From nobody Sun Feb 8 17:03:52 2026 Received: from mail-lf1-f52.google.com (mail-lf1-f52.google.com [209.85.167.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF092230BF6 for ; Sun, 21 Dec 2025 15:58:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766332702; cv=none; b=tfQg74gg9WY4IT535b0mgFcsjQuFCsyLXjuRgvjEpUxKjFvmg2PNgtbOIFy5otvkPmZxXeq96hbFnS90S456FPMNEw7EmQyG9kJwqpUGQFIDmai5TIjTF/o9Yv2HZwChHcKaRpNP6oBVbVtOJZGu4kDpqWY3mSX4AMJjRYrfWUg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766332702; c=relaxed/simple; bh=lkq5qhaPOy9GB/0N+6pHSvyWfFkF37st9nnLEmV0YXM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HQic/NBgRpYfeiSmwJkey739SuTS6TvZp9f32HE5wVdLQiYd7DMS10DpBGxW931m7KcbRrHuF4kSyEc9ngRwVGfV9nOSE6VmDKaMB4M+Pgd0Bcf/5xIQXE4jjyRGOIxXdP9WOt9uhYJs/ha3tQlrK3BsAAaXG/dw30g5oSCRXHg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AEZBqOzZ; arc=none smtp.client-ip=209.85.167.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AEZBqOzZ" Received: by mail-lf1-f52.google.com with SMTP id 2adb3069b0e04-594285c6509so3488639e87.0 for ; Sun, 21 Dec 2025 07:58:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766332699; x=1766937499; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=kNeI+dhYeL+33zxK5LQPaTyz87+4mfQ+I3kJAxqFlR8=; b=AEZBqOzZtQijDxciz4EHE3NUb20C6SCtKaF4k+kkfwpawmpMdIPlwSdRSJlj4JS0DE q+R3vYQUMmGm/Wz88n7DN7EW24KzLr6bw/LawWWhblHgYlRwY1gHCnE3T7fXzuSGamIx eCh/wvBMgKZp17cfaLcqvWWMvHDgInCxavQIeolUUsiLgMBFkRdcuyopfw5GoHNhW+fs fyjZSr7QR8ajn6RgIo+MI9EHzs+tOHf337XjsaTJyAH5DNpOU83354/WL5CU/sEE/EKj UG29t5vnu4TRroN96kN/plwNZJ6ENBX38dHKkwa7wvwDE4g1qOQF44XdF7ggBTgMsX0n n2/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766332699; x=1766937499; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=kNeI+dhYeL+33zxK5LQPaTyz87+4mfQ+I3kJAxqFlR8=; b=fxLn0A5ouENo963ce7nJfWREWfEFigucsVpXC2IlmB2Y3gWOdO9Df0Lyj829J0QJ++ ZaEFwO2JcE16cykg84t+SY2gUkiqcSWvFKmi64IGo8WOAyNFjH175v2GPHhIDTMMKTd9 9XGgg20fR6OLfyxNZ98h7C22oxYjAC164Mlv64ZyGStDuKKkkUFuvg97xcQI/plEES4i FdO7iu35w4ijj+9r3MqdZFVvIFFNBvjQ7mfmYI5g/MZMIWHAVLtn/dwY0dTos5PfTb1L 0EpDZKtaLQgeyByVAXp1Bb1pUj47ntTrosufE8WRhQHoiLXKbTFxNgzjlbI35Ac1dEqB NEoA== X-Gm-Message-State: AOJu0YxI3UYMnT+kSTRfcP1VmnQxjGboOMdkhTARledmhTzGMLUDjuME 5lZGzvyG2BEwjlIPHs0sX+hW/Nrom6r977Axe+s7z6jDaQa+GVLJf6jo X-Gm-Gg: AY/fxX7/cASolzwMr1ML7IUzjk6nfiaAApRWguFs5b2tCYQfRkRoVEgt/M/8+b6V66O vhsdSfT8IK8h72F1B8/oAwrFv0ecio+dbqeiUY1xQlDS5iAdOiOwdIj9zu8y35f7HjC67bkkwO5 ngdGFkvHwIuF0D9qasrwIQOF1vWuCR1TVT2OKCtD/+8t/an+dx0eGYKeyUbqJibDgD3r5NM5h4G /2SPxjnA0Rr2m1MS/M6BTXCyPzrTHPaPN+zuxoZnreo+G/gMp0dj10yoMv0RLinJxt+SaDpc51k 1kmDca+GKQ++7a/jird6sqmESybktSlYvfV4Br3uQjKd8uoemphSRa/JM+fUfOWiJKAA8Ux1Jjl bkzzsMz/sOOjaSe2sFEKhAEFDEC2EDCn95r3QXOKInu11PXRJed9/blmVToj76CvorM0kcnczje w= X-Google-Smtp-Source: AGHT+IHdm338vAoXflPAN8iunsh7MDg3zRHLIvShdCzJhtVkx0t0KXG+vk8KpzbxDV4G5hGHMuLIPw== X-Received: by 2002:a05:6512:ac5:b0:598:f361:68f7 with SMTP id 2adb3069b0e04-59a17cff3b6mr3446011e87.4.1766332698815; Sun, 21 Dec 2025 07:58:18 -0800 (PST) Received: from prometheus ([85.11.110.37]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-59a185d5fdbsm2379493e87.21.2025.12.21.07.58.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 21 Dec 2025 07:58:18 -0800 (PST) From: Szymon Wilczek To: linux-wireless@vger.kernel.org, libertas-dev@lists.infradead.org Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Szymon Wilczek , syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com Subject: [PATCH] wifi: libertas: fix WARNING in usb_tx_block Date: Sun, 21 Dec 2025 16:58:06 +0100 Message-ID: <20251221155806.23925-1-swilczek.lx@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The function usb_tx_block() submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed. If a second call occurs while the URB is still active (e.g. during rapid firmware loading), usb_submit_urb() detects the active state and triggers a warning: 'URB submitted while active'. Fix this by enforcing serialization: call usb_kill_urb() before submitting the new request. This ensures the URB is idle and safe to reuse. Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D67969ab6a2551c27f71b Signed-off-by: Szymon Wilczek --- drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/w= ireless/marvell/libertas/if_usb.c index b3c4040257a6..924ab93b7b67 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint= 8_t *payload, uint16_t nb goto tx_ret; } =20 + usb_kill_urb(cardp->tx_urb); + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, usb_sndbulkpipe(cardp->udev, cardp->ep_out), --=20 2.52.0