In the Linux kernel, the following vulnerability has been resolved:
net: mctp: usb: fix race between urb completion and rx_retry cancellation
It’s possible that sequencing between setting ->stopped and cancelling
the rx_retry work (in ndo_stop) could leave us with an urb queued:
T1: ndo_stop T2: rx_retry_work
———— —————-
LD: ->stopped => false
ST: ->stopped rx_stopped, and cancelling pending work, we know that the
requeue cannot occur, so all that’s left is killing any pending urb.
