I cloned git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux.git as you are testing changes there. > commit 09e4522c87ff54c655c09f318a68b012eda8eb01 (HEAD -> usbip_test, origin/usbip_test) > Author: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> > Date: Thu Mar 11 11:18:25 2021 -0700 > > usbip: fix vhci races in connection tear down > > - Change vhci_device_reset() to reset tcp_socket and sockfd. > if !in_disconnect How it can happen? vhci_device_reset() can be called only after vhci_shutdown_connection() completed, and vhci_shutdown_connection() from subsequent requests cannot be called until vhci_device_reset() completes. I consider it as a dead code which should be removed by my "[PATCH v4 05/12] usb: usbip: don't reset tcp_socket at vhci_device_reset()". And what you are missing in your [PATCH 4,5,6/6] is diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c index c4457026d5ad..3c64bd06ab53 100644 --- a/drivers/usb/usbip/vhci_sysfs.c +++ b/drivers/usb/usbip/vhci_sysfs.c @@ -423,6 +423,7 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, /* end the lock */ wake_up_process(vdev->ud.tcp_rx); + schedule_timeout_uninterruptible(HZ); // Consider being preempted here. wake_up_process(vdev->ud.tcp_tx); rh_port_connect(vdev, speed); . wake_up_process(tcp_tx) can call vhci_shutdown_connection() before wake_up_process(tcp_tx) is called. Since vhci_shutdown_connection() destroys tcp_tx thread and releases tcp_tx memory via kthread_stop_put(tcp_tx), wake_up_process(tcp_tx) will access already freed memory. Your patch converted "NULL pointer dereference caused by failing to call kthread_stop_put(tcp_tx)" into "use after free caused by succeeding to call kthread_stop_put(tcp_tx)".