[PATCH RFC v2] Input: yealink - abort URB submission on fatal errors

[PATCH RFC v2] Input: yealink - abort URB submission on fatal errors

[syzbot]

The yealink driver uses two URBs (interrupt and control) to communicate
with the device. When an URB completes with an error status (such as
-EPROTO), the completion handlers (urb_irq_callback and urb_ctl_callback)
log the error but do not abort. Instead, they proceed to process the
potentially invalid data and unconditionally resubmit the URB.

Because control URBs are not rate-limited by the USB core, resubmitting a
failing control URB in a tight loop floods the console with error messages
and keeps the CPU completely busy in the softirq context. This eventually
triggers an RCU preempt stall:

yealink 3-1:36.0: unexpected response 0
yealink 3-1:36.0: urb_ctl_callback - urb status -71
rcu: INFO: rcu_preempt self-detected stall on CPU
Call Trace:
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
 dev_vprintk_emit+0x338/0x400 drivers/base/core.c:4996
 dev_printk_emit+0xee/0x140 drivers/base/core.c:5007
 usb_generic_driver_probe+0x10b/0x150 drivers/usb/core/generic.c:252
 ...
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5953
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436

Fix this by explicitly checking the URB status for fatal errors (-ENOENT,
-ECONNRESET, -ESHUTDOWN, -EPROTO, -EPIPE, -EILSEQ) in both
urb_irq_callback() and urb_ctl_callback(). If a fatal error is detected,
the callback now returns early, breaking the infinite resubmission loop and
preventing the RCU stall.

Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone")
Assisted-by: Gemini:gemini-3.8-flash syzbot
Reported-by: syzbot+78e2288f58b881ed3c45@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=78e2288f58b881ed3c45
Link: https://syzkaller.appspot.com/ai_job?id=479730c2-f271-451c-a31b-837d89cb018e
To: "Henk Vergonet" <Henk.Vergonet@gmail.com>
To: "Dmitry Torokhov" <dmitry.torokhov@gmail.com>
To: <linux-input@vger.kernel.org>
Cc: <linux-kernel@vger.kernel.org>

---
v2:
- Factored out fatal error checks into is_fatal_error() helper

v1:
https://lore.kernel.org/all/57cf484d-3235-473f-a61d-570585626176@mail.kernel.org/T/
---
diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
index 560f895a0..bf91f40cd 100644
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -400,14 +400,32 @@ static int yealink_do_idle_tasks(struct yealink_dev *yld)
  * error,start
  *
  */
+static bool is_fatal_error(int status)
+{
+	switch (status) {
+	case -ENOENT:
+	case -ECONNRESET:
+	case -ESHUTDOWN:
+	case -EPROTO:
+	case -EPIPE:
+	case -EILSEQ:
+		return true;
+	default:
+		return false;
+	}
+}
+
 static void urb_irq_callback(struct urb *urb)
 {
 	struct yealink_dev *yld = urb->context;
 	int ret, status = urb->status;
 
-	if (status)
+	if (status) {
 		dev_err(&yld->intf->dev, "%s - urb status %d\n",
 			__func__, status);
+		if (is_fatal_error(status))
+			return;
+	}
 
 	switch (yld->irq_data->cmd) {
 	case CMD_KEYPRESS:
@@ -443,9 +461,12 @@ static void urb_ctl_callback(struct urb *urb)
 	struct yealink_dev *yld = urb->context;
 	int ret = 0, status = urb->status;
 
-	if (status)
+	if (status) {
 		dev_err(&yld->intf->dev, "%s - urb status %d\n",
 			__func__, status);
+		if (is_fatal_error(status))
+			return;
+	}
 
 	switch (yld->ctl_data->cmd) {
 	case CMD_KEYPRESS:


base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH RFC v2] Input: yealink - abort URB submission on fatal errors

[Slawomir Stepien]

On wrz 14, 2026 09:09, syzbot wrote:
> The yealink driver uses two URBs (interrupt and control) to communicate
> with the device. When an URB completes with an error status (such as
> -EPROTO), the completion handlers (urb_irq_callback and urb_ctl_callback)
> log the error but do not abort. Instead, they proceed to process the
> potentially invalid data and unconditionally resubmit the URB.
> 
> Because control URBs are not rate-limited by the USB core, resubmitting a
> failing control URB in a tight loop floods the console with error messages
> and keeps the CPU completely busy in the softirq context. This eventually
> triggers an RCU preempt stall:
> 
> yealink 3-1:36.0: unexpected response 0
> yealink 3-1:36.0: urb_ctl_callback - urb status -71
> rcu: INFO: rcu_preempt self-detected stall on CPU
> Call Trace:
>  __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
>  console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
>  dev_vprintk_emit+0x338/0x400 drivers/base/core.c:4996
>  dev_printk_emit+0xee/0x140 drivers/base/core.c:5007
>  usb_generic_driver_probe+0x10b/0x150 drivers/usb/core/generic.c:252
>  ...
>  hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5953
>  worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
>  kthread+0x388/0x470 kernel/kthread.c:436
> 
> Fix this by explicitly checking the URB status for fatal errors (-ENOENT,
> -ECONNRESET, -ESHUTDOWN, -EPROTO, -EPIPE, -EILSEQ) in both
> urb_irq_callback() and urb_ctl_callback(). If a fatal error is detected,
> the callback now returns early, breaking the infinite resubmission loop and
> preventing the RCU stall.
> 
> Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone")
> Assisted-by: Gemini:gemini-3.8-flash syzbot
> Reported-by: syzbot+78e2288f58b881ed3c45@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=78e2288f58b881ed3c45
> Link: https://syzkaller.appspot.com/ai_job?id=479730c2-f271-451c-a31b-837d89cb018e
> To: "Henk Vergonet" <Henk.Vergonet@gmail.com>
> To: "Dmitry Torokhov" <dmitry.torokhov@gmail.com>
> To: <linux-input@vger.kernel.org>
> Cc: <linux-kernel@vger.kernel.org>
> 
> ---
> v2:
> - Factored out fatal error checks into is_fatal_error() helper
> 
> v1:
> https://lore.kernel.org/all/57cf484d-3235-473f-a61d-570585626176@mail.kernel.org/T/
> ---
> diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
> index 560f895a0..bf91f40cd 100644
> --- a/drivers/input/misc/yealink.c
> +++ b/drivers/input/misc/yealink.c
> @@ -400,14 +400,32 @@ static int yealink_do_idle_tasks(struct yealink_dev *yld)
>   * error,start
>   *
>   */
> +static bool is_fatal_error(int status)
> +{
> +	switch (status) {
> +	case -ENOENT:
> +	case -ECONNRESET:
> +	case -ESHUTDOWN:
> +	case -EPROTO:
> +	case -EPIPE:
> +	case -EILSEQ:
> +		return true;
> +	default:
> +		return false;
> +	}
> +}
> +
>  static void urb_irq_callback(struct urb *urb)
>  {
>  	struct yealink_dev *yld = urb->context;
>  	int ret, status = urb->status;
>  
> -	if (status)
> +	if (status) {
>  		dev_err(&yld->intf->dev, "%s - urb status %d\n",
>  			__func__, status);
> +		if (is_fatal_error(status))
> +			return;

Lets change the approach here. Drop the is_fatal_error() and:
1. switch on status: if the status is 0 just break of out the switch.
2. If there status is one of -ECONNRESET, -ENOENT, -ESHUTDOWN or -ENODEV return quick since we
cannot recover from these.
3. For other cases, try to resubmit the urb if !yld->shutdown.

Do the same also for urb_ctl_callback.

In addition to that, change dev_err to rate limiting version in both callbacks.

> +	}
>  
>  	switch (yld->irq_data->cmd) {
>  	case CMD_KEYPRESS:
> @@ -443,9 +461,12 @@ static void urb_ctl_callback(struct urb *urb)
>  	struct yealink_dev *yld = urb->context;
>  	int ret = 0, status = urb->status;
>  
> -	if (status)
> +	if (status) {
>  		dev_err(&yld->intf->dev, "%s - urb status %d\n",
>  			__func__, status);
> +		if (is_fatal_error(status))
> +			return;
> +	}
>  
>  	switch (yld->ctl_data->cmd) {
>  	case CMD_KEYPRESS:
> 
> 
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f

-- 
Slawomir Stepien