From nobody Tue Apr 7 09:22:48 2026 Received: from fanzine2.igalia.com (fanzine2.igalia.com [213.97.179.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB717383C77; Fri, 13 Mar 2026 21:28:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.97.179.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773437317; cv=none; b=P77ySmtwlt+RKBTXXAvx4e0Kn1AxfTO2knCQ+XtjjNE+9DOKPLXffj5zA71OJ0LmWgQxMcFvWogc3kCstQwv7sqDOPE/MlmCIJjQr7SrovkqrHksJhgYb6ClwyKp9j6CVXsfIiVdEo2n2B215SrKuRQ3634yFUbeI9U725ABWi0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773437317; c=relaxed/simple; bh=BiSayE4X/AHhfUxoL2VF88TJEBL7c6Ay/Ox9DM/4S4A=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kXH6TO2EuonyuqpCxdwDikWFiIfdoDOhnnr0lqLH8sMMKcaNUBTTVF/8zfphB1X6DWMwg8Vyo+SPdKJl2e8P51YyqeMEzpyBbHO2K8RgMaYmnYsXN/h3rtpNRZU4Jn8ZeCtu1l7oPoFpBxqZWVO5cU0T8oCcDgYv26HjI/H0fgU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com; spf=pass smtp.mailfrom=igalia.com; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b=q5CFfSRi; arc=none smtp.client-ip=213.97.179.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=igalia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b="q5CFfSRi" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=aMF023Uvh9HyQgJBywtj4fEU0ZRbBwL78zphGqevtkM=; b=q5CFfSRiuKfYPj2UNV3DDZ0w1z IkCwVIUiDdF3AsL7vYB39wBa5Hd+1nutNu0i3ih3UeXVBvEWMY935BXyLQ0eAQfLbqF7SNy95SzXg tvevHwV30qbWaEuO2ZP2+V2ku15RDVYAcTBX8Wppb9QFpQt3Oah4rHlYBY+TwG4C/ZVKX1gCeglDI K33z9V3PS3BFoDPjmCcyN1FIMYcSxID/WxiiKzJn0j518H40PSRhEvbenvnfG+iZVYry/o238Qt6e Dx95KXOraxPhX5WVrhSF+/cjgdM1fu8dQo7hrTBEux9PRoC/8bL9v+7MbC8GM0xfjcdPyDG/5hkyG i8R9P3WQ==; Received: from 189-14-81-93.vmaxnet.com.br ([189.14.81.93] helo=[127.0.1.1]) by fanzine2.igalia.com with esmtpsa (Cipher TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim) id 1w1A3d-00FRhq-CL; Fri, 13 Mar 2026 22:28:33 +0100 From: Heitor Alves de Siqueira Date: Fri, 13 Mar 2026 18:27:57 -0300 Subject: [PATCH 1/2] wifi: libertas: use USB anchors for tracking in-flight URBs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260313-libertas-usb-anchors-v1-1-915afbe988d7@igalia.com> References: <20260313-libertas-usb-anchors-v1-0-915afbe988d7@igalia.com> In-Reply-To: <20260313-libertas-usb-anchors-v1-0-915afbe988d7@igalia.com> To: Johannes Berg , Szymon Wilczek Cc: linux-wireless@vger.kernel.org, libertas-dev@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-dev@igalia.com X-Mailer: b4 0.14.3 The libertas driver currently handles URB lifecycles manually, which makes it non-trivial to check if specific URBs are pending or not. Add anchors for TX/RX URBs, and use those to track in-flight requests. Signed-off-by: Heitor Alves de Siqueira --- drivers/net/wireless/marvell/libertas/if_usb.c | 27 ++++++++++++++++------= ---- drivers/net/wireless/marvell/libertas/if_usb.h | 3 +++ 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/w= ireless/marvell/libertas/if_usb.c index 8a6bf1365cfa..11cd1422f46a 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -114,8 +114,8 @@ static void if_usb_write_bulk_callback(struct urb *urb) static void if_usb_free(struct if_usb_card *cardp) { /* Unlink tx & rx urb */ - usb_kill_urb(cardp->tx_urb); - usb_kill_urb(cardp->rx_urb); + usb_kill_anchored_urbs(&cardp->tx_submitted); + usb_kill_anchored_urbs(&cardp->rx_submitted); =20 usb_free_urb(cardp->tx_urb); cardp->tx_urb =3D NULL; @@ -221,6 +221,9 @@ static int if_usb_probe(struct usb_interface *intf, udev->descriptor.bDeviceSubClass, udev->descriptor.bDeviceProtocol); =20 + init_usb_anchor(&cardp->rx_submitted); + init_usb_anchor(&cardp->tx_submitted); + for (i =3D 0; i < iface_desc->desc.bNumEndpoints; ++i) { endpoint =3D &iface_desc->endpoint[i].desc; if (usb_endpoint_is_bulk_in(endpoint)) { @@ -426,7 +429,7 @@ static int usb_tx_block(struct if_usb_card *cardp, uint= 8_t *payload, uint16_t nb goto tx_ret; } =20 - usb_kill_urb(cardp->tx_urb); + usb_kill_anchored_urbs(&cardp->tx_submitted); =20 usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, usb_sndbulkpipe(cardp->udev, @@ -435,8 +438,10 @@ static int usb_tx_block(struct if_usb_card *cardp, uin= t8_t *payload, uint16_t nb =20 cardp->tx_urb->transfer_flags |=3D URB_ZERO_PACKET; =20 + usb_anchor_urb(cardp->tx_urb, &cardp->tx_submitted); if ((ret =3D usb_submit_urb(cardp->tx_urb, GFP_ATOMIC))) { lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret); + usb_unanchor_urb(cardp->tx_urb); } else { lbs_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n"); ret =3D 0; @@ -467,8 +472,10 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *= cardp, cardp); =20 lbs_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb); + usb_anchor_urb(cardp->rx_urb, &cardp->rx_submitted); if ((ret =3D usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) { lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret); + usb_unanchor_urb(cardp->rx_urb); kfree_skb(skb); cardp->rx_skb =3D NULL; ret =3D -1; @@ -838,8 +845,8 @@ static void if_usb_prog_firmware(struct lbs_private *pr= iv, int ret, } =20 /* Cancel any pending usb business */ - usb_kill_urb(cardp->rx_urb); - usb_kill_urb(cardp->tx_urb); + usb_kill_anchored_urbs(&cardp->rx_submitted); + usb_kill_anchored_urbs(&cardp->tx_submitted); =20 cardp->fwlastblksent =3D 0; cardp->fwdnldover =3D 0; @@ -869,8 +876,8 @@ static void if_usb_prog_firmware(struct lbs_private *pr= iv, int ret, if (cardp->bootcmdresp =3D=3D BOOT_CMD_RESP_NOT_SUPPORTED) { /* Return to normal operation */ ret =3D -EOPNOTSUPP; - usb_kill_urb(cardp->rx_urb); - usb_kill_urb(cardp->tx_urb); + usb_kill_anchored_urbs(&cardp->rx_submitted); + usb_kill_anchored_urbs(&cardp->tx_submitted); if (if_usb_submit_rx_urb(cardp) < 0) ret =3D -EIO; goto done; @@ -900,7 +907,7 @@ static void if_usb_prog_firmware(struct lbs_private *pr= iv, int ret, wait_event_interruptible(cardp->fw_wq, cardp->surprise_removed || cardp->= fwdnldover); =20 timer_delete_sync(&cardp->fw_timeout); - usb_kill_urb(cardp->rx_urb); + usb_kill_anchored_urbs(&cardp->rx_submitted); =20 if (!cardp->fwdnldover) { pr_info("failed to load fw, resetting device!\n"); @@ -960,8 +967,8 @@ static int if_usb_suspend(struct usb_interface *intf, p= m_message_t message) goto out; =20 /* Unlink tx & rx urb */ - usb_kill_urb(cardp->tx_urb); - usb_kill_urb(cardp->rx_urb); + usb_kill_anchored_urbs(&cardp->tx_submitted); + usb_kill_anchored_urbs(&cardp->rx_submitted); =20 out: return ret; diff --git a/drivers/net/wireless/marvell/libertas/if_usb.h b/drivers/net/w= ireless/marvell/libertas/if_usb.h index 7d0daeb33c3f..a0cd36197c2b 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.h +++ b/drivers/net/wireless/marvell/libertas/if_usb.h @@ -48,6 +48,9 @@ struct if_usb_card { struct urb *rx_urb, *tx_urb; struct lbs_private *priv; =20 + struct usb_anchor rx_submitted; + struct usb_anchor tx_submitted; + struct sk_buff *rx_skb; =20 uint8_t ep_in; --=20 2.53.0 From nobody Tue Apr 7 09:22:48 2026 Received: from fanzine2.igalia.com (fanzine2.igalia.com [213.97.179.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A332E3845A3; Fri, 13 Mar 2026 21:28:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.97.179.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773437319; cv=none; b=NCdnfHl/Y4X7OlaNP7CKabvyljCbC90GiYJwjDnelkyEIKrEOeInbTBaJ0ZSq9Bf6MR5RZi/8tb1CJwaHMbc+xU0h8csOXfyejFUR/1c/u2EG/b9bM0Aqk9wq3mvwBu90ToZhgw24BSD7EMQWLwcdIZA4uhkX6Pca7lA2b09DPg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773437319; c=relaxed/simple; bh=W75rJzcQ9OqjLMj37j3eU7ccV8Fk+yD0YTYrhsXASVk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UejRbwqD3G17bP6UnOWWsuoAJCuyHdtH7QFBzZ1GHN37MpvfqRW9DpOsZ9ZyIId24WH4ntmu0VPOacOV2oe6sRB4mHFgH6w2RTSDjBbAnutxK7u/RHfDw24j8oiZTXEgSBFVaFGgDsoK5iMoOidqFzBpBatqromgafArCLi0D+c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com; spf=pass smtp.mailfrom=igalia.com; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b=BBJ1OgFR; arc=none smtp.client-ip=213.97.179.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=igalia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b="BBJ1OgFR" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From:Sender: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=iPJMovgEDfKBBMN9a4vOtIg1aTmb+ZeSY/mDll1OlFY=; b=BBJ1OgFRDC/MivY5/YXJF5/JXe kzaURJ8HGWTn0Oh3qa/Jcwt9TJRGfqsMi8NVqFlR5TYVb5tGGMHIKerRzphjUsPQvjUrDQp2i99FU oGl/tv7X3s3XYg7sVCgnh67GFLh+hB0rQzAC5XBx8xyvLlwbfey3Kg74Di4NaAlqJfdAtYdaIEVrK DhG8K0cBuxbJl4bg+cTyKmYnrP1bdXn+Tq6JehgM6kj7Jet1heEvJPqafpKfMsjP4kFc9zDwWhAwu S05lhSYRBfLn5Ae4FrOO4KCezw72XnWGdiVJ/rfcY+3FcI/fE5iod2NkFCXaq4v/rfH55kIE6Mftz XzcIQfoA==; Received: from 189-14-81-93.vmaxnet.com.br ([189.14.81.93] helo=[127.0.1.1]) by fanzine2.igalia.com with esmtpsa (Cipher TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim) id 1w1A3f-00FRhq-E6; Fri, 13 Mar 2026 22:28:35 +0100 From: Heitor Alves de Siqueira Date: Fri, 13 Mar 2026 18:27:58 -0300 Subject: [PATCH 2/2] wifi: libertas: don't kill URBs in interrupt context Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260313-libertas-usb-anchors-v1-2-915afbe988d7@igalia.com> References: <20260313-libertas-usb-anchors-v1-0-915afbe988d7@igalia.com> In-Reply-To: <20260313-libertas-usb-anchors-v1-0-915afbe988d7@igalia.com> To: Johannes Berg , Szymon Wilczek Cc: linux-wireless@vger.kernel.org, libertas-dev@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-dev@igalia.com, syzbot+74afbb6355826ffc2239@syzkaller.appspotmail.com X-Mailer: b4 0.14.3 Serialization for the TX path was enforced by calling usb_kill_urb()/usb_kill_anchored_urbs(), to prevent transmission before a previous URB was completed. usb_tx_block() can be called from interrupt context (e.g. in the HCD giveback path), so we can't always use it to kill in-flight URBs. Prevent sleeping during interrupt context by checking the tx_submitted anchor for existing URBs. We now return -EBUSY, to indicate there's a pending request. Reported-by: syzbot+74afbb6355826ffc2239@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D74afbb6355826ffc2239 Fixes: d66676e6ca96 ("wifi: libertas: fix WARNING in usb_tx_block") Signed-off-by: Heitor Alves de Siqueira --- drivers/net/wireless/marvell/libertas/if_usb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/w= ireless/marvell/libertas/if_usb.c index 11cd1422f46a..d3b9f7619a1a 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -429,7 +429,12 @@ static int usb_tx_block(struct if_usb_card *cardp, uin= t8_t *payload, uint16_t nb goto tx_ret; } =20 - usb_kill_anchored_urbs(&cardp->tx_submitted); + /* check if there are pending URBs */ + if (!usb_anchor_empty(&cardp->tx_submitted)) { + lbs_deb_usbd(&cardp->udev->dev, "%s failed: pending URB\n", __func__); + ret =3D -EBUSY; + goto tx_ret; + } =20 usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, usb_sndbulkpipe(cardp->udev, --=20 2.53.0