[PATCH 0/2] usb: gadget: avoid warnings during configuration transitions

[PATCH 0/2] usb: gadget: avoid warnings during configuration transitions

[Keisuke Tsukuda]

Rapidly alternating SET_CONFIGURATION requests can overtake the
mass-storage function's asynchronous configuration work. This exposes two
states that are handled safely but currently produce kernel warnings: a
delayed-status completion after reset_config() cleared its counter, and a
class request while common->fsg is not installed.

The first patch keeps the obsolete completion as a dynamic-debug
diagnostic. The second avoids the warning only in fsg_setup(), where the
request is already rejected with -EOPNOTSUPP; warnings in other internal
f_mass_storage paths remain unchanged.

Both reports reproduce on an ARM64 Ubuntu 6.8 VM using dummy_hcd. With both
patches loaded, five 10-second, four-thread runs produced no WARNING, BUG,
or Oops. In a separate run, a kprobe observed five calls to
usb_composite_setup_continue() with delayed_status == 0 while the target
warning remained absent.

syzbot tested this exact series on usb-testing commit
edc1518454f6439e50a9220e9a3ba09044ea8d8b and reported OK after a
50-minute run:

https://syzkaller.appspot.com/bug?extid=a83a5a1ba9ff57935171

Keisuke Tsukuda (2):
  usb: gadget: composite: avoid warning on aborted delayed status
  usb: gadget: f_mass_storage: ignore class requests while inactive

 drivers/usb/gadget/composite.c               | 2 +-
 drivers/usb/gadget/function/f_mass_storage.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.50.1 (Apple Git-155)

[PATCH 1/2] usb: gadget: composite: avoid warning on aborted delayed status

[Keisuke Tsukuda]

A SET_CONFIGURATION request that disables the current configuration, or a
disconnect, can abort a control transfer whose status stage was delayed by
a function driver. The asynchronous function work can nevertheless finish
later and call usb_composite_setup_continue() after reset_config() has
cleared delayed_status.

This is an expected consequence of aborting the old control transfer, and
does not require a kernel warning. Keep the diagnostic available under
dynamic debug and ignore the obsolete completion as before.

Fixes: 2bac51a1827a ("usb: gadget: composite: reset delayed_status on reset_config")
Reported-by: syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a83a5a1ba9ff57935171
Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
---
 drivers/usb/gadget/composite.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index df39e34..1b22381 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2740,7 +2740,7 @@ void usb_composite_setup_continue(struct usb_composite_dev *cdev)
 	spin_lock_irqsave(&cdev->lock, flags);
 
 	if (cdev->delayed_status == 0) {
-		WARN(cdev, "%s: Unexpected call\n", __func__);
+		DBG(cdev, "%s: Ignoring obsolete call\n", __func__);
 
 	} else if (--cdev->delayed_status == 0) {
 		DBG(cdev, "%s: Completing delayed status\n", __func__);
-- 
2.50.1 (Apple Git-155)

[PATCH 2/2] usb: gadget: f_mass_storage: ignore class requests while inactive

[Keisuke Tsukuda]

SET_CONFIGURATION is handled asynchronously by the mass-storage thread.
A class request can arrive after the composite core selects the function
but before the thread installs common->fsg, or while the function is being
disabled.

fsg_setup() already rejects this state with -EOPNOTSUPP, but checking it
through fsg_is_set() also emits a warning. Check the active function
directly so normal requests during a configuration transition are rejected
without hiding fsg_is_set() warnings from other internal paths.

Fixes: 8876f5e7d3b2 ("USB: gadget: f_mass_storage: added eject callback")
Reported-by: syzbot+d31109047baed8f3b590@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d31109047baed8f3b590
Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
---
 drivers/usb/gadget/function/f_mass_storage.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index a50743c..52d486a 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -463,7 +463,7 @@ static int fsg_setup(struct usb_function *f,
 	u16			w_value = le16_to_cpu(ctrl->wValue);
 	u16			w_length = le16_to_cpu(ctrl->wLength);
 
-	if (!fsg_is_set(fsg->common))
+	if (!fsg->common->fsg)
 		return -EOPNOTSUPP;
 
 	++fsg->common->ep0_req_tag;	/* Record arrival of a new request */
-- 
2.50.1 (Apple Git-155)

Re: [PATCH 2/2] usb: gadget: f_mass_storage: ignore class requests while inactive

[Alan Stern]

On Mon, Sep 07, 2026 at 08:58:42AM +0000, Keisuke Tsukuda wrote:
> SET_CONFIGURATION is handled asynchronously by the mass-storage thread.
> A class request can arrive after the composite core selects the function
> but before the thread installs common->fsg, or while the function is being
> disabled.
> 
> fsg_setup() already rejects this state with -EOPNOTSUPP, but checking it
> through fsg_is_set() also emits a warning. Check the active function
> directly so normal requests during a configuration transition are rejected
> without hiding fsg_is_set() warnings from other internal paths.
> 
> Fixes: 8876f5e7d3b2 ("USB: gadget: f_mass_storage: added eject callback")
> Reported-by: syzbot+d31109047baed8f3b590@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d31109047baed8f3b590
> Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
> ---
>  drivers/usb/gadget/function/f_mass_storage.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
> index a50743c..52d486a 100644
> --- a/drivers/usb/gadget/function/f_mass_storage.c
> +++ b/drivers/usb/gadget/function/f_mass_storage.c
> @@ -463,7 +463,7 @@ static int fsg_setup(struct usb_function *f,
>  	u16			w_value = le16_to_cpu(ctrl->wValue);
>  	u16			w_length = le16_to_cpu(ctrl->wLength);
>  
> -	if (!fsg_is_set(fsg->common))
> +	if (!fsg->common->fsg)

I'd feel better about this if there was a comment here explaining why 
calling fsg_is_set() is a bad idea.

Alan Stern

>  		return -EOPNOTSUPP;
>  
>  	++fsg->common->ep0_req_tag;	/* Record arrival of a new request */
> -- 
> 2.50.1 (Apple Git-155)
> 
> 

Re: [PATCH 2/2] usb: gadget: f_mass_storage: ignore class requests while inactive

[Keisuke Tsukuda]

Sorry, my previous reply was sent as HTML and rejected by the mailing list.

Thanks Alan-san. That makes sense. I'll add a comment in v2.

Regards,
Keisuke