usbnet_resume_rx() uses local_bh_disable() to synchronize with usbnet_skb_return(), but local_bh_disable() only affects the local CPU. On SMP, usbnet_skb_return() on CPU0 can pass the test_bit() check while CPU1 runs usbnet_resume_rx(), clears the flag and drains the queue, leaving the skb stranded in rxq_pause until the next MTU change or device stop. Fix with a double-check pattern under rxq_pause.lock: normal RX avoids the lock via an unlocked test_bit() fast path; on the slow path the lock is taken and the flag rechecked before enqueuing. Move clear_bit() in usbnet_resume_rx() under the same lock to make the flag and queue transitions atomic. Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change") Signed-off-by: Ömer Mete Kaya --- drivers/net/usb/usbnet.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 0288d89e1d13..5eba2cef8bac 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -329,13 +329,15 @@ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb) unsigned long flags; int status; - spin_lock_bh(&dev->rxq_pause.lock); - if (test_bit(EVENT_RX_PAUSED, &dev->flags)) { - __skb_queue_tail(&dev->rxq_pause, skb); + if (unlikely(test_bit(EVENT_RX_PAUSED, &dev->flags))) { + spin_lock_bh(&dev->rxq_pause.lock); + if (test_bit(EVENT_RX_PAUSED, &dev->flags)) { + __skb_queue_tail(&dev->rxq_pause, skb); + spin_unlock_bh(&dev->rxq_pause.lock); + return; + } spin_unlock_bh(&dev->rxq_pause.lock); - return; } - spin_unlock_bh(&dev->rxq_pause.lock); /* only update if unset to allow minidriver rx_fixup override */ if (skb->protocol == 0) -- 2.55.0