In the Linux kernel, the following vulnerability has been resolved:
net: usb: Remove disruptive netifwakequeue in rtl8150setmulticast
syzbot reported WARNING in rtl8150startxmit/usbsubmiturb. This is the sequence of events that leads to the warning:
rtl8150startxmit() { netifstopqueue(); usbsubmiturb(dev->tx_urb); }
rtl8150setmulticast() { netifstopqueue(); netifwakequeue(); <-- wakes up TX queue before URB is done }
rtl8150startxmit() { netifstopqueue(); usbsubmiturb(dev->tx_urb); <-- double submission }
rtl8150setmulticast being the ndosetrxmode callback should not be calling netifstopqueue and notifstart_queue as these handle TX queue synchronization.
The net core function devsetrxmode handles the synchronization for rtl8150set_multicast making it safe to remove these locks.