All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers
@ 2026-10-21  8:16 Lee Yongjun
  2026-10-21  8:22 ` sashiko-bot
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Lee Yongjun @ 2026-10-21  8:16 UTC (permalink / raw)
  To: stern, gregkh
  Cc: digidietze, xiehongyu1, linux-usb, usb-storage, linux-kernel,
	syzkaller-bugs, syzbot+7317196294d50d6e55c3, Lee Yongjun

The Option device initialization path issues bulk transfers
without a timeout. If a device does not complete a transfer,
the USB hub worker can remain blocked while holding the device
mutex, causing usb_device_read() to hang.

Use the timeout-aware bulk transfer helper for the transfers
in option_inquiry() and option_rezero(). This bounds the wait
for each probe-time transfer to 5 seconds.

Tested with the syzkaller C reproducer under QEMU/KVM. The
patched kernel repeatedly progressed through the USB device
initialization path after approximately 5 seconds without
triggering the previously observed hung-task warning.

Fixes: 32ebbe7b6ad4 ("USB: usb-storage: add filter to "option_ms" to leave unrecognized devices alone")
Reported-by: syzbot+7317196294d50d6e55c3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7317196294d50d6e55c3
Signed-off-by: Lee Yongjun <jun85566@gmail.com>
---
Changes in v2:
- Reduce the timeout from 30 to 5 seconds.
- Move the dependency note below the --- separator.
- Remove the extra blank line before Signed-off-by.

This patch depends on Hongyu Xie's pending v3 series:
https://lore.kernel.org/r/20261001123135.38831-1-xy521521@gmail.com/

v1: https://lore.kernel.org/all/20261013132033.4352-1-jun85566@gmail.com/

 drivers/usb/storage/option_ms.c | 38 +++++++++++++++++----------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/drivers/usb/storage/option_ms.c b/drivers/usb/storage/option_ms.c
index 7c0b05a36554..d844fcaaf3fc 100644
--- a/drivers/usb/storage/option_ms.c
+++ b/drivers/usb/storage/option_ms.c
@@ -10,6 +10,7 @@
 #include <linux/usb.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/jiffies.h>
 
 #include "usb.h"
 #include "transport.h"
@@ -18,6 +19,7 @@
 
 #define ZCD_FORCE_MODEM			0x01
 #define ZCD_ALLOW_MS 			0x02
+#define OPTION_MS_PROBE_TIMEOUT		(5 * HZ)
 
 static unsigned int option_zero_cd = ZCD_FORCE_MODEM;
 module_param(option_zero_cd, uint, S_IRUGO | S_IWUSR);
@@ -44,9 +46,9 @@ static int option_rezero(struct us_data *us)
 		return USB_STOR_TRANSPORT_ERROR;
 
 	memcpy(buffer, rezero_msg, sizeof(rezero_msg));
-	result = usb_stor_bulk_transfer_buf(us,
-			us->send_bulk_pipe,
-			buffer, sizeof(rezero_msg), NULL);
+	result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
+						    buffer, sizeof(rezero_msg), NULL,
+						    OPTION_MS_PROBE_TIMEOUT);
 	if (result != USB_STOR_XFER_GOOD) {
 		result = USB_STOR_XFER_ERROR;
 		goto out;
@@ -56,14 +58,14 @@ static int option_rezero(struct us_data *us)
 	 * Some of the devices need to be asked for a response, but we don't
 	 * care what that response is.
 	 */
-	usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, RESPONSE_LEN, NULL);
+	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+					   buffer, RESPONSE_LEN, NULL,
+					   OPTION_MS_PROBE_TIMEOUT);
 
 	/* Read the CSW */
-	usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, 13, NULL);
+	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+					   buffer, 13, NULL,
+					   OPTION_MS_PROBE_TIMEOUT);
 
 	result = USB_STOR_XFER_GOOD;
 
@@ -90,17 +92,17 @@ static int option_inquiry(struct us_data *us)
 		return USB_STOR_TRANSPORT_ERROR;
 
 	memcpy(buffer, inquiry_msg, sizeof(inquiry_msg));
-	result = usb_stor_bulk_transfer_buf(us,
-			us->send_bulk_pipe,
-			buffer, sizeof(inquiry_msg), NULL);
+	result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
+						    buffer, sizeof(inquiry_msg), NULL,
+						    OPTION_MS_PROBE_TIMEOUT);
 	if (result != USB_STOR_XFER_GOOD) {
 		result = USB_STOR_XFER_ERROR;
 		goto out;
 	}
 
-	result = usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, 0x24, NULL);
+	result = usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+						    buffer, 0x24, NULL,
+						    OPTION_MS_PROBE_TIMEOUT);
 	if (result != USB_STOR_XFER_GOOD) {
 		result = USB_STOR_XFER_ERROR;
 		goto out;
@@ -112,9 +114,9 @@ static int option_inquiry(struct us_data *us)
 		result = memcmp(buffer+8, "ZCOPTION", 8);
 
 	/* Read the CSW */
-	usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, 13, NULL);
+	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+					   buffer, 13, NULL,
+					   OPTION_MS_PROBE_TIMEOUT);
 
 out:
 	kfree(buffer);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers
@ 2026-10-28 12:26 kernel test robot
  0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2026-10-28 12:26 UTC (permalink / raw)
  To: oe-kbuild; +Cc: lkp

:::::: 
:::::: Manual check reason: "linux-review patch is more than 7 days old, verify it wasn't already superseded"
:::::: 

BCC: lkp@intel.com
CC: llvm@lists.linux.dev
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <20261021081616.89976-1-jun85566@gmail.com>
References: <20261021081616.89976-1-jun85566@gmail.com>
TO: Lee Yongjun <jun85566@gmail.com>
TO: stern@rowland.harvard.edu
TO: gregkh@linuxfoundation.org
CC: digidietze@draisberghof.de
CC: xiehongyu1@kylinos.cn
CC: linux-usb@vger.kernel.org
CC: usb-storage@lists.one-eyed-alien.net
CC: linux-kernel@vger.kernel.org
CC: syzkaller-bugs@googlegroups.com
CC: syzbot+7317196294d50d6e55c3@syzkaller.appspotmail.com
CC: Lee Yongjun <jun85566@gmail.com>

Hi Lee,

kernel test robot noticed the following build errors:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v7.3 next-20261027]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Lee-Yongjun/usb-storage-option_ms-bound-probe-time-bulk-transfers/20261021-171616
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20261021081616.89976-1-jun85566%40gmail.com
patch subject: [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers
:::::: branch date: 7 days ago
:::::: commit date: 7 days ago
config: hexagon-allmodconfig (https://download.01.org/0day-ci/archive/20261028/202610282041.qJu7njvL-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 186e70f4e6a1521991d2340d3d49b23b1beff11f)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261028/202610282041.qJu7njvL-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202610282041.qJu7njvL-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/usb/storage/option_ms.c:49:11: error: call to undeclared function 'usb_stor_bulk_transfer_buf_timeout'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
      49 |         result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
         |                  ^
   drivers/usb/storage/option_ms.c:49:11: note: did you mean 'usb_stor_bulk_transfer_buf'?
   drivers/usb/storage/transport.h:80:12: note: 'usb_stor_bulk_transfer_buf' declared here
      80 | extern int usb_stor_bulk_transfer_buf(struct us_data *us, unsigned int pipe,
         |            ^
   drivers/usb/storage/option_ms.c:95:11: error: call to undeclared function 'usb_stor_bulk_transfer_buf_timeout'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
      95 |         result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
         |                  ^
   2 errors generated.


vim +/usb_stor_bulk_transfer_buf_timeout +49 drivers/usb/storage/option_ms.c

281b064f237205 Dan Williams   2008-12-14  30  
32ebbe7b6ad44a Josua Dietze   2009-05-24  31  static int option_rezero(struct us_data *us)
281b064f237205 Dan Williams   2008-12-14  32  {
38502ef49f96f7 Colin Ian King 2017-09-12  33  	static const unsigned char rezero_msg[] = {
281b064f237205 Dan Williams   2008-12-14  34  	  0x55, 0x53, 0x42, 0x43, 0x78, 0x56, 0x34, 0x12,
281b064f237205 Dan Williams   2008-12-14  35  	  0x01, 0x00, 0x00, 0x00, 0x80, 0x00, 0x06, 0x01,
281b064f237205 Dan Williams   2008-12-14  36  	  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
281b064f237205 Dan Williams   2008-12-14  37  	  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
281b064f237205 Dan Williams   2008-12-14  38  	};
281b064f237205 Dan Williams   2008-12-14  39  	char *buffer;
281b064f237205 Dan Williams   2008-12-14  40  	int result;
281b064f237205 Dan Williams   2008-12-14  41  
191648d03d2022 Joe Perches    2013-04-19  42  	usb_stor_dbg(us, "Option MS: %s\n", "DEVICE MODE SWITCH");
281b064f237205 Dan Williams   2008-12-14  43  
281b064f237205 Dan Williams   2008-12-14  44  	buffer = kzalloc(RESPONSE_LEN, GFP_KERNEL);
281b064f237205 Dan Williams   2008-12-14  45  	if (buffer == NULL)
281b064f237205 Dan Williams   2008-12-14  46  		return USB_STOR_TRANSPORT_ERROR;
281b064f237205 Dan Williams   2008-12-14  47  
281b064f237205 Dan Williams   2008-12-14  48  	memcpy(buffer, rezero_msg, sizeof(rezero_msg));
30fed35a2ad8a1 Lee Yongjun    2026-10-21 @49  	result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
30fed35a2ad8a1 Lee Yongjun    2026-10-21  50  						    buffer, sizeof(rezero_msg), NULL,
30fed35a2ad8a1 Lee Yongjun    2026-10-21  51  						    OPTION_MS_PROBE_TIMEOUT);
281b064f237205 Dan Williams   2008-12-14  52  	if (result != USB_STOR_XFER_GOOD) {
281b064f237205 Dan Williams   2008-12-14  53  		result = USB_STOR_XFER_ERROR;
281b064f237205 Dan Williams   2008-12-14  54  		goto out;
281b064f237205 Dan Williams   2008-12-14  55  	}
281b064f237205 Dan Williams   2008-12-14  56  
f0183a338e4f90 Felipe Balbi   2016-04-18  57  	/*
f0183a338e4f90 Felipe Balbi   2016-04-18  58  	 * Some of the devices need to be asked for a response, but we don't
281b064f237205 Dan Williams   2008-12-14  59  	 * care what that response is.
281b064f237205 Dan Williams   2008-12-14  60  	 */
30fed35a2ad8a1 Lee Yongjun    2026-10-21  61  	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
30fed35a2ad8a1 Lee Yongjun    2026-10-21  62  					   buffer, RESPONSE_LEN, NULL,
30fed35a2ad8a1 Lee Yongjun    2026-10-21  63  					   OPTION_MS_PROBE_TIMEOUT);
32ebbe7b6ad44a Josua Dietze   2009-05-24  64  
32ebbe7b6ad44a Josua Dietze   2009-05-24  65  	/* Read the CSW */
30fed35a2ad8a1 Lee Yongjun    2026-10-21  66  	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
30fed35a2ad8a1 Lee Yongjun    2026-10-21  67  					   buffer, 13, NULL,
30fed35a2ad8a1 Lee Yongjun    2026-10-21  68  					   OPTION_MS_PROBE_TIMEOUT);
32ebbe7b6ad44a Josua Dietze   2009-05-24  69  
281b064f237205 Dan Williams   2008-12-14  70  	result = USB_STOR_XFER_GOOD;
281b064f237205 Dan Williams   2008-12-14  71  
281b064f237205 Dan Williams   2008-12-14  72  out:
281b064f237205 Dan Williams   2008-12-14  73  	kfree(buffer);
281b064f237205 Dan Williams   2008-12-14  74  	return result;
281b064f237205 Dan Williams   2008-12-14  75  }
281b064f237205 Dan Williams   2008-12-14  76  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-10-28 12:27 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-21  8:16 [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers Lee Yongjun
2026-10-21  8:22 ` sashiko-bot
2026-10-21  9:48 ` Oliver Neukum
2026-10-21 22:22 ` kernel test robot
  -- strict thread matches above, loose matches on Subject: below --
2026-10-28 12:26 kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.