[PATCH 0/6] usbip: vhci_hcd: fix URB giveback leaks and disconnect races

[Raul E Rangel]

This series fixes a set of URB lifecycle, locking, and disconnect
teardown bugs in drivers/usb/usbip/vhci_hcd that can orphan pending URBs
and wedge usb_kill_urb() and usb_hub_wq in uninterruptible D state when
a virtual USB port disconnects under concurrent transfer/unlink load.

Patch breakdown:
  1. Protect urb->hcpriv accesses in vhci_urb_dequeue() with
     vdev->priv_lock inside vhci->lock (matching vhci_urb_enqueue() and
     the cleanup helpers), and add a !portnum || portnum > VHCI_HC_PORTS
     bounds guard to both vhci_urb_enqueue() and vhci_urb_dequeue().
  2. Track whether an URB has been moved from vdev->priv_tx to
     vdev->priv_rx via priv->submitted under vdev->priv_lock, and
     complete unsent (!priv->submitted) URBs locally in
     vhci_urb_dequeue() instead of queuing a CMD_UNLINK PDU. This
     prevents vhci_device_unlink_cleanup() from freeing the unlink entry
     and orphaning an unsent URB on priv_tx, and prevents CMD_UNLINK
     from being transmitted before CMD_SUBMIT on an active connection.
  3. Clear vdev->ud.tcp_socket under vhci->lock and vdev->ud.lock in
     vhci_shutdown_connection(), reject vhci_urb_enqueue() once
     USBIP_EH_SHUTDOWN is set or tcp_socket is NULL, and drain all
     remaining URBs on vdev->priv_tx and vdev->priv_rx in
     vhci_device_unlink_cleanup().
  4. Move the URB_DMA_MAP_SG clearing from vhci_recv_ret_submit() into
     pickup_urb_and_free_priv() and also clear URB_DMA_MAP_SG in
     vhci_urb_dequeue() and vhci_cleanup_priv_list() so USB core does
     not call dma_unmap_sg() on unmapped scatterlists on any giveback
     path.
  5. Allocate struct vhci_priv with mem_flags before acquiring spinlocks
     in vhci_urb_enqueue(), and return 0 (with VDEV_EVENT_ERROR_MALLOC
     triggered) if struct vhci_unlink allocation fails in
     vhci_urb_dequeue() after usb_hcd_check_unlink_urb() has already
     marked urb->unlinked.
  6. Serialize vdev->udev clearing in vhci_device_reset() under
     vhci->lock and ud->lock (dropping old usb_device and socket
     references outside the spinlocks in both vhci_device_reset() and
     vhci_urb_enqueue()), and reject URBs from a stale usb_device
     (including address-0 requests from an already-registered
     usb_device undergoing USBDEVFS_RESET) if the same rhport is
     re-attached before usb_hub_wq finishes disconnecting the old
     device.

Testing:
  - Built at every commit in the series with W=1 (0 warnings, 0 errors).
  - Verified under User-Mode Linux (ARCH=um, UP with CONFIG_PREEMPT=y,
    CONFIG_PROVE_LOCKING=y, CONFIG_KASAN=y, CONFIG_DEBUG_ATOMIC_SLEEP=y,
    CONFIG_USBIP_VHCI_HCD=y, CONFIG_USBIP_DEBUG=y):
    * Test 1: Abrupt server disconnect mid-transfer while client threads
      loop 32 KiB scatter-gather (num_sgs=2, URB_DMA_MAP_SG) SUBMITURB,
      DISCARDURB, USBDEVFS_CONTROL, and USBDEVFS_RESET (5/5 cycles,
      0 D-state tasks).
    * Test 2: 500 rapid SUBMITURB + DISCARDURB + REAPURB iterations on a
      live connection, plus deterministic verification with a stalled
      tx socket that unlinking 40 unsent URBs on priv_tx completes them
      locally with 0 CMD_UNLINK PDUs sent on the wire.
    * Test 3: Immediate detach + re-attach on the same rhport while a
      client thread submits URBs on the old usbfs fd, confirming all
      stale submits fail with -ENODEV and 0 stale CMD_SUBMIT packets
      reach the new server.
    * Test 3B: Deterministic reproduction of the field deadlock sequence
      (unsent URB queued on priv_tx while tcp_socket != NULL, followed
      by concurrent USBDEVFS_RESET and server socket close), completing
      with 0 D-state tasks.
    * Test 4: Lockdep (debug_locks = 1) and KASAN clean across all runs.
  - Built and soaked for 18.5+ hours (280 cycles) on an SMP gLinux host
    (7.1.6-1rodete1-amd64) where the original usb_disconnect() /
    usb_kill_urb() deadlock was captured, completing 125,000+ EP0
    control transfers, 21,000+ async URB unlinks, 8+ GiB of
    scatter-gather USB Mass Storage bulk reads, 1,000+ mid-transfer
    SIGKILL client aborts, and 850+ live USB/IP socket disconnect
    teardowns and port re-attachments under active load with 0 kernel
    warnings and 0 hung tasks.


Raul E Rangel (6):
  usbip: vhci_hcd: protect urb->hcpriv with priv_lock in
    vhci_urb_dequeue()
  usbip: vhci_hcd: complete unsent URBs locally in vhci_urb_dequeue()
  usbip: vhci_hcd: stop enqueue and drain all pending URBs on disconnect
  usbip: vhci_hcd: clear URB_DMA_MAP_SG on all giveback paths
  usbip: vhci_hcd: allocate vhci_priv outside lock and handle ENOMEM
  usbip: vhci_hcd: reject URBs from stale usb_device after port
    re-attach

 drivers/usb/usbip/vhci.h     |   1 +
 drivers/usb/usbip/vhci_hcd.c | 236 +++++++++++++++++++++++------------
 drivers/usb/usbip/vhci_rx.c  |   6 +-
 drivers/usb/usbip/vhci_tx.c  |   1 +
 4 files changed, 162 insertions(+), 82 deletions(-)

-- 
2.56.0.212.g129ede20d9-goog