Re: [PATCH RFC v3] Input: yealink - abort URB submission on fatal errors

[Slawomir Stepien <sst@poczta.fm>]

On wrz 18, 2026 16:55, syzbot wrote:
> The yealink driver uses two URBs (interrupt and control) to communicate
> with the device. When an URB completes with an error status (such as
> -EPROTO), the completion handlers (urb_irq_callback and urb_ctl_callback)
> log the error but do not abort. Instead, they proceed to process the
> potentially invalid data and unconditionally resubmit the URB.
> 
> Because control URBs are not rate-limited by the USB core, resubmitting a
> failing control URB in a tight loop floods the console with error messages
> and keeps the CPU completely busy in the softirq context. This eventually
> triggers an RCU preempt stall:
> 
> yealink 3-1:36.0: unexpected response 0
> yealink 3-1:36.0: urb_ctl_callback - urb status -71
> rcu: INFO: rcu_preempt self-detected stall on CPU
> Call Trace:
>  __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
>  console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
>  dev_vprintk_emit+0x338/0x400 drivers/base/core.c:4996
>  dev_printk_emit+0xee/0x140 drivers/base/core.c:5007
>  usb_generic_driver_probe+0x10b/0x150 drivers/usb/core/generic.c:252
>  ...
>  hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5953
>  worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
>  kthread+0x388/0x470 kernel/kthread.c:436
> 
> Fix this by checking the URB status for fatal errors (-ECONNRESET, -ENOENT,
> -ESHUTDOWN, -ENODEV) in both urb_irq_callback() and urb_ctl_callback(). If
> a fatal error is detected, the callback now returns early, breaking the
> resubmission loop. For other non-zero statuses, skip processing the
> response data and jump directly to resubmission. Additionally, use
> dev_err_ratelimited() instead of dev_err() to prevent flooding the console
> and triggering an RCU stall.
> 
> Fixes: aca951a22a1d ("[PATCH] input-driver-yealink-P1K-usb-phone")
> Assisted-by: Gemini:gemini-3.8-flash syzbot
> Reported-by: syzbot+78e2288f58b881ed3c45@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=78e2288f58b881ed3c45
> Link: https://syzkaller.appspot.com/ai_job?id=24a48a3f-a005-45ce-9020-4a27b38d9683
> To: "Henk Vergonet" <Henk.Vergonet@gmail.com>
> To: "Dmitry Torokhov" <dmitry.torokhov@gmail.com>
> To: <linux-input@vger.kernel.org>
> Cc: <linux-kernel@vger.kernel.org>
> 
> ---
> v3:
> - Only abort URB submission on fatal errors (-ECONNRESET, -ENOENT, -ESHUTDOWN, -ENODEV).
> - Skip processing packet data and jump directly to resubmission on non-fatal errors.
> - Use dev_err_ratelimited() instead of dev_err() to prevent console flooding.
> - Drop is_fatal_error() helper in favor of switch statements.
> 
> v2:
> - Factored out fatal error checks into is_fatal_error() helper
> https://lore.kernel.org/all/2a0b5e96-dd8a-4ce9-ba3f-dd9efa26275d@mail.kernel.org/T/
> 
> v1:
> https://lore.kernel.org/all/57cf484d-3235-473f-a61d-570585626176@mail.kernel.org/T/
> ---
> diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
> index 560f895a0..c67c619db 100644
> --- a/drivers/input/misc/yealink.c
> +++ b/drivers/input/misc/yealink.c
> @@ -405,9 +405,19 @@ static void urb_irq_callback(struct urb *urb)
>  	struct yealink_dev *yld = urb->context;
>  	int ret, status = urb->status;
>  
> -	if (status)
> -		dev_err(&yld->intf->dev, "%s - urb status %d\n",
> -			__func__, status);
> +	switch (status) {
> +	case 0:
> +		break;
> +	case -ECONNRESET:
> +	case -ENOENT:
> +	case -ESHUTDOWN:
> +	case -ENODEV:
> +		return;
> +	default:
> +		dev_err_ratelimited(&yld->intf->dev, "%s - urb status %d\n",
> +				    __func__, status);
> +		goto resubmit;
> +	}
>  
>  	switch (yld->irq_data->cmd) {
>  	case CMD_KEYPRESS:
> @@ -429,12 +439,13 @@ static void urb_irq_callback(struct urb *urb)
>  
>  	yealink_do_idle_tasks(yld);
>  
> +resubmit:
>  	if (!yld->shutdown) {
>  		ret = usb_submit_urb(yld->urb_ctl, GFP_ATOMIC);
>  		if (ret && ret != -EPERM)
> -			dev_err(&yld->intf->dev,
> -				"%s - usb_submit_urb failed %d\n",
> -				__func__, ret);
> +			dev_err_ratelimited(&yld->intf->dev,
> +					    "%s - usb_submit_urb failed %d\n",
> +					    __func__, ret);
>  	}
>  }
>  
> @@ -443,9 +454,19 @@ static void urb_ctl_callback(struct urb *urb)
>  	struct yealink_dev *yld = urb->context;
>  	int ret = 0, status = urb->status;
>  
> -	if (status)
> -		dev_err(&yld->intf->dev, "%s - urb status %d\n",
> -			__func__, status);
> +	switch (status) {
> +	case 0:
> +		break;
> +	case -ECONNRESET:
> +	case -ENOENT:
> +	case -ESHUTDOWN:
> +	case -ENODEV:
> +		return;
> +	default:
> +		dev_err_ratelimited(&yld->intf->dev, "%s - urb status %d\n",
> +				    __func__, status);
> +		goto resubmit;

I do not like this jump to inside a default case. Maybe just check for yld->shutdown and do
usb_submit_urb here and then do goto to lines below to check ret value?

> +	}
>  
>  	switch (yld->ctl_data->cmd) {
>  	case CMD_KEYPRESS:
> @@ -457,14 +478,16 @@ static void urb_ctl_callback(struct urb *urb)
>  	default:
>  		/* send new command */
>  		yealink_do_idle_tasks(yld);
> +resubmit:
>  		if (!yld->shutdown)
>  			ret = usb_submit_urb(yld->urb_ctl, GFP_ATOMIC);
>  		break;
>  	}
>  
>  	if (ret && ret != -EPERM)
> -		dev_err(&yld->intf->dev, "%s - usb_submit_urb failed %d\n",
> -			__func__, ret);
> +		dev_err_ratelimited(&yld->intf->dev,
> +				    "%s - usb_submit_urb failed %d\n",
> +				    __func__, ret);
>  }
>  
>  /*******************************************************************************
> 
> 
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f

-- 
Slawomir Stepien