[PATCH] net: mctp: Fix tx queue stall

[Marc Olberding]

From: Jinliang Wang <jinliangw at google.com>

The tx queue can become permanently stuck in a stopped state due to a
race condition between the URB submission path and its completion
callback.

The URB completion callback can run immediately after usb_submit_urb()
returns, before the submitting function calls netif_stop_queue(). If
this occurs, the queue state management becomes desynchronized, leading
to a stall where the queue is never woken.

Fix this by moving the netif_stop_queue() call to before submitting the
URB. This closes the race window by ensuring the network stack is aware
the queue is stopped before the URB completion can possibly run.

(cherry picked from commit da2522df3fcc6f57068470cbdcd6516d9eb76b37)

Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver")
Signed-off-by: Jinliang Wang <jinliangw at google.com>
Acked-by: Jeremy Kerr <jk at codeconstruct.com.au>
Link: https://patch.msgid.link/20251027065530.2045724-1-jinliangw@google.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
---
Backports a fix from net-next to openbmc 6.12 for a race condition
in the mctp-usb driver that results in an effective deadlock.
This was seen to fix issues on the nvl32-obmc model with pldm
firmware update

Signed-off-by: Marc Olberding <molberding at nvidia.com>
---
 drivers/net/mctp/mctp-usb.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mctp/mctp-usb.c b/drivers/net/mctp/mctp-usb.c
index c398aa45e40da4e36e8e179d0d49c473647b1ba2..f7936f952d17e43dde12853922fdda9ca5985c8d 100644
--- a/drivers/net/mctp/mctp-usb.c
+++ b/drivers/net/mctp/mctp-usb.c
@@ -97,11 +97,13 @@ static netdev_tx_t mctp_usb_start_xmit(struct sk_buff *skb,
 			  skb->data, skb->len,
 			  mctp_usb_out_complete, skb);
 
+	/* Stops TX queue first to prevent race condition with URB complete */
+	netif_stop_queue(dev);
 	rc = usb_submit_urb(urb, GFP_ATOMIC);
-	if (rc)
+	if (rc) {
+		netif_wake_queue(dev);
 		goto err_drop;
-	else
-		netif_stop_queue(dev);
+	}
 
 	return NETDEV_TX_OK;
 

---
base-commit: 3943d5e3e529495cf46ed1487af0edd54bf7b31d
change-id: 20251121-mctpusb-backport-65940e2c79f2

Best regards,
-- 
Marc Olberding <molberding at nvidia.com>