Re: [PATCH] usb-storage: prevent concurrent URB submission in usb_stor_msg_common

On Thu, Aug 20, 2026 at 12:03:45PM +0800, liuqi wrote:
> From 054ed55aaa0d80edc93d25e4750d67e9064bb77f Mon Sep 17 00:00:00 2001
> From: liuqi <[email protected]>
> Date: Thu, 20 Aug 2026 11:28:43 +0800
> Subject: [PATCH] usb-storage: prevent concurrent URB submission in
>  usb_stor_msg_common
> 
> usb_stor_msg_common() only checks the ABORTING flag before submitting
> the URB, but does not guard against concurrent submissions when a
> previous URB is still in-flight (e.g., from a BULK_MAX_LUN probe
> running in scan_dwork while scsi_eh also invokes the same function).

Why would the scsi_eh (or any other part of the SCSI stack) submit 
commands before scsi_scan_host() has started?

> This leads to "URB submitted while active" warnings and -EINPROGRESS
> returns when usb_submit_urb() detects an already-queued/in-flight URB.

Have you actually observed this happening?

Alan Stern

> Fix by using test_and_set_bit() on US_FLIDX_URB_ACTIVE to mutually
> exclude concurrent submissions. If a URB is already active, return
> -EAGAIN to the caller.
> 
> Reported-by: [email protected]
> Signed-off-by: liuqi <[email protected]>
> ---
>  drivers/usb/storage/transport.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
> index f79b449d0..ffb1459d0 100644
> --- a/drivers/usb/storage/transport.c
> +++ b/drivers/usb/storage/transport.c
> @@ -122,6 +122,16 @@ static int usb_stor_msg_common(struct us_data *us, int timeout)
>  	if (test_bit(US_FLIDX_ABORTING, &us->dflags))
>  		return -EIO;
>  
> +	/*
> +	 * Prevent concurrent submissions of the same URB.
> +	 * If a URB is already in-flight (e.g., from a previous
> +	 * BULK_MAX_LUN probe running in scan_dwork while scsi_eh
> +	 * also invokes the same function), reject new submissions.
> +	 */
> +	if (test_and_set_bit(US_FLIDX_URB_ACTIVE, &us->dflags))
> +		return -EAGAIN;
> +
> +
>  	/* set up data structures for the wakeup system */
>  	init_completion(&urb_done);
>  
> -- 
> 2.43.0
>