YoyoChan

I do not have an Unraid system, but I have the same problem with another system. I found that the kernel panic occurs because the 8 bytes of memory are experiencing a use-after-free (UAF) issue. When the message "xhci_hcd 0000:03:00.0: WARN Successful completion on short TX" appears, the kernel puts the URB into the async_completed list because the TRB completion code is COMP_SUCCESS in the process_bulk_intr_td function. Unfortunately, the USB device copy data via DMA to the transfer_buffer of the URB continue, which has been freed by free_async function. As a result, when the next kmalloc is called, a UAF error causes the kernel to crash. This bug only appears with certain USB devices, but unfortunately, I do not have access to those devices. Perhaps someone who encounters this problem can debug the kernel function process_bulk_intr_td and report the bug to the community. Edited just now by YoyoChan

I do not have an Unraid system, but I have the same problem with another system. I found that the kernel panic occurs because the 8 bytes of memory are experiencing a use-after-free (UAF) issue. When the message "xhci_hcd 0000:03:00.0: WARN Successful completion on short TX" appears, the kernel puts the URB into the async_completed list because the TRB completion code is COMP_SUCCESS in the process_bulk_intr_td function. However, the USB device will copy data via DMA to the transfer_buffer of the URB, which has been freed by free_async function. As a result, when the next kmalloc is called, a UAF error causes the kernel to crash. This bug only appears with certain USB devices, but unfortunately, I do not have access to those devices. Perhaps someone who encounters this problem can debug the kernel function process_bulk_intr_td and report the bug to the community.