Re: [syzbot] [usb?] BUG: sleeping function called from invalid context in usb_tx_block

[Hillf Danton]

> Date: Tue, 24 Feb 2026 10:56:23 -0800	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8bf22c33e7a1 Merge tag 'net-7.0-rc1' of git://git.kernel.o..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=127b9722580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1ff39736314a9939
> dashboard link: https://syzkaller.appspot.com/bug?extid=74afbb6355826ffc2239
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1561fffa580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1031795a580000

#syz test

--- x/drivers/net/wireless/marvell/libertas/if_usb.h
+++ y/drivers/net/wireless/marvell/libertas/if_usb.h
@@ -44,7 +44,7 @@ struct bootcmdresp
 /* USB card description structure*/
 struct if_usb_card {
 	struct usb_device *udev;
-	uint32_t model;  /* MODEL_* */
+	uint32_t tx_in_flight, model;  /* MODEL_* */
 	struct urb *rx_urb, *tx_urb;
 	struct lbs_private *priv;
 
--- x/drivers/net/wireless/marvell/libertas/if_usb.c
+++ y/drivers/net/wireless/marvell/libertas/if_usb.c
@@ -86,6 +86,7 @@ static void if_usb_write_bulk_callback(s
 {
 	struct if_usb_card *cardp = (struct if_usb_card *) urb->context;
 
+	cardp->tx_in_flight--;
 	/* handle the transmission complete validations */
 
 	if (urb->status == 0) {
@@ -425,8 +426,11 @@ static int usb_tx_block(struct if_usb_ca
 		ret = -ENODEV;
 		goto tx_ret;
 	}
-
-	usb_kill_urb(cardp->tx_urb);
+	if (cardp->tx_in_flight++) {
+		cardp->tx_in_flight--;
+		ret = -EBUSY;
+		goto tx_ret;
+	}
 
 	usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
 			  usb_sndbulkpipe(cardp->udev,
@@ -436,6 +440,7 @@ static int usb_tx_block(struct if_usb_ca
 	cardp->tx_urb->transfer_flags |= URB_ZERO_PACKET;
 
 	if ((ret = usb_submit_urb(cardp->tx_urb, GFP_ATOMIC))) {
+		cardp->tx_in_flight--;
 		lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret);
 	} else {
 		lbs_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n");
--