From: syzbot <syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com>
To: stern@rowland.harvard.edu
Cc: linux-usb@vger.kernel.org, stern@rowland.harvard.edu,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: INFO: rcu detected stall in dummy_timer (3)
Date: Thu, 23 Apr 2026 09:05:38 -0700 [thread overview]
Message-ID: <69ea4352.a00a0220.17a17.0041.GAE@google.com> (raw)
In-Reply-To: <c23ff4f3-16a1-46ff-946e-b5dbda209f57@rowland.harvard.edu>
> I'm revisiting an old syzbot bug caused by a tight resubmit loop, this
> one in mceusb. The bug was fixed by commit 476db72e5219 ("media:
> mceusb: return without resubmitting URB in case of -EPROTO error."), but
> I want to try fixing it a different way, by changing dummy-hcd.
>
> This is a preliminary test, to make sure the bug can still be triggered.
> The patch below doesn't do anything -- yet!
>
> Alan Stern
>
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 811d22141369
This bug is already marked as fixed. No point in testing.
>
> Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -231,6 +231,7 @@ struct urbp {
> struct list_head urbp_list;
> struct sg_mapping_iter miter;
> u32 miter_started;
> + int missing_ep_delay;
> };
>
>
> @@ -1275,6 +1276,7 @@ static int dummy_urb_enqueue(
> return -ENOMEM;
> urbp->urb = urb;
> urbp->miter_started = 0;
> + urbp->missing_ep_delay = 80; /* Microframes -> 10 ms */
>
> dum_hcd = hcd_to_dummy_hcd(hcd);
> spin_lock_irqsave(&dum_hcd->dum->lock, flags);
> @@ -1863,6 +1865,8 @@ restart:
> address |= USB_DIR_IN;
> ep = find_endpoint(dum, address);
> if (!ep) {
> +// if (--urbp->missing_ep_delay > 0)
> +// continue;
> /* set_configuration() disagreement */
> dev_dbg(dummy_dev(dum_hcd),
> "no ep configured for urb %p\n",
next prev parent reply other threads:[~2026-04-23 16:05 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-23 16:05 INFO: rcu detected stall in dummy_timer (3) Alan Stern
2026-04-23 16:05 ` syzbot [this message]
2026-04-23 16:11 ` Alan Stern
-- strict thread matches above, loose matches on Subject: below --
2020-07-14 16:27 syzbot
2020-07-14 19:47 ` Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69ea4352.a00a0220.17a17.0041.GAE@google.com \
--to=syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.