diff options
| author | Szymon Wilczek <swilczek.lx@gmail.com> | 2025-12-21 18:58:06 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-01-08 15:44:27 +0300 |
| commit | d66676e6ca96bf8680f869a9bd6573b26c634622 (patch) | |
| tree | 7c8e25403853d43cbd707d499901dc5f0fa65429 | |
| parent | 7bab5bdb81e33cd0bc0aa848931ff47940ad54b0 (diff) | |
| download | linux-d66676e6ca96bf8680f869a9bd6573b26c634622.tar.xz | |
wifi: libertas: fix WARNING in usb_tx_block
The function usb_tx_block() submits cardp->tx_urb without ensuring that
any previous transmission on this URB has completed. If a second call
occurs while the URB is still active (e.g. during rapid firmware loading),
usb_submit_urb() detects the active state and triggers a warning:
'URB submitted while active'.
Fix this by enforcing serialization: call usb_kill_urb() before
submitting the new request. This ensures the URB is idle and safe to reuse.
Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | drivers/net/wireless/marvell/libertas/if_usb.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c index b3c4040257a6..924ab93b7b67 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb goto tx_ret; } + usb_kill_urb(cardp->tx_urb); + usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, usb_sndbulkpipe(cardp->udev, cardp->ep_out), |