From: Szymon Wilczek <[email protected]>
Date: 21 Dec 2025
Subject: [PATCH] wifi: libertas: fix WARNING in usb_tx_block
Merged: 8 Jan 2026, by Johannes Berg
The function usb_tx_block() submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed. If a second call occurs while the URB is still active (e.g. during rapid firmware loading), usb_submit_urb() detects the active state and triggers a warning: 'URB submitted while active'.
Fix this by enforcing serialization: call usb_kill_urb() before submitting the new request. This ensures the URB is idle and safe to reuse.
signed, reported, fixes
- Reported-by syzbot reported it
- Signed-off-by Szymon Wilczek author
- Signed-off-by Johannes Berg maintainer · merged it
diff
@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb goto tx_ret; } + usb_kill_urb(cardp->tx_urb);+ usb_fill_bulk_urb(cardp->tx_urb, cardp->udev, usb_sndbulkpipe(cardp->udev, cardp->ep_out),discussion · on the list
v1 · 1 message
Szymon Wilczek author 21 Dec 2025
[PATCH] wifi: libertas: fix WARNING in usb_tx_block