Re: [PATCH 02/19] USB: core: signal the end of an sg request last

[Alan Stern]

On Tue, Oct 27, 2026 at 03:57:42PM +0100, Greg Kroah-Hartman wrote:
> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> 
> sg_complete() and usb_sg_cancel() call complete() with io->lock held and
> unlock afterwards. usb_sg_wait() does not take the lock again after
> wait_for_completion(), so it can return while the other CPU has not
> unlocked yet:
> 
>   CPU0 (giveback)                     CPU1 (usb_sg_wait())
>   spin_lock_irqsave(&io->lock)
>   io->count--
>   complete(&io->complete)
>                                       wait_for_completion() returns
>                                       sg_clean(io), return
>                                       the caller reuses the request
>   spin_unlock_irqrestore(&io->lock)

Wouldn't it be simpler just to make usb_sg_wait() take and release the 
spinlock before it calls sg_clean()?  Then the routines calling 
complete() would be guaranteed to have finished using the io structure.

Alan Stern