On Wed, 24 Sept 2025 at 13:17, Michal Pecio [off-list ref] wrote:

It's not freeing which matters but URB completion in the USB subsystem.

Does URB completion include both successful and failed completions? I
decided to go
with "free urb" because I wasn't sure of that.

I think this description is needlessly complex, the essence is:

rtl8150_start_xmit() {
        netif_stop_queue();
        usb_submit_urb(dev->tx_urb);
}

rtl8150_set_multicast() {
        netif_stop_queue();
        netif_wake_queue();  <-- wakes up TX queue before URB is done
}

rtl8150_start_xmit() {
        netif_stop_queue();
        usb_submit_urb(dev->tx_urb);    <-- double submission
}

I wasn't sure how to describe the flow of execution in a multi threaded program.
I will resubmit a v3 with this version of the execution flow

quoted

Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: I Viswanath <redacted>

Tested-by: Michal Pecio <redacted>

Thanks,
Viswanath