[PATCH] usb-storage: prevent concurrent URB submission in usb_stor_msg_common

From 054ed55aaa0d80edc93d25e4750d67e9064bb77f Mon Sep 17 00:00:00 2001
From: liuqi <[email protected]>
Date: Thu, 20 Aug 2026 11:28:43 +0800
Subject: [PATCH] usb-storage: prevent concurrent URB submission in
 usb_stor_msg_common

usb_stor_msg_common() only checks the ABORTING flag before submitting
the URB, but does not guard against concurrent submissions when a
previous URB is still in-flight (e.g., from a BULK_MAX_LUN probe
running in scan_dwork while scsi_eh also invokes the same function).

This leads to "URB submitted while active" warnings and -EINPROGRESS
returns when usb_submit_urb() detects an already-queued/in-flight URB.

Fix by using test_and_set_bit() on US_FLIDX_URB_ACTIVE to mutually
exclude concurrent submissions. If a URB is already active, return
-EAGAIN to the caller.

Reported-by: [email protected]
Signed-off-by: liuqi <[email protected]>
---
 drivers/usb/storage/transport.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index f79b449d0..ffb1459d0 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -122,6 +122,16 @@ static int usb_stor_msg_common(struct us_data *us, int timeout)
 	if (test_bit(US_FLIDX_ABORTING, &us->dflags))
 		return -EIO;
 
+	/*
+	 * Prevent concurrent submissions of the same URB.
+	 * If a URB is already in-flight (e.g., from a previous
+	 * BULK_MAX_LUN probe running in scan_dwork while scsi_eh
+	 * also invokes the same function), reject new submissions.
+	 */
+	if (test_and_set_bit(US_FLIDX_URB_ACTIVE, &us->dflags))
+		return -EAGAIN;
+
+
 	/* set up data structures for the wakeup system */
 	init_completion(&urb_done);
 
-- 
2.43.0