[PATCH v2 0/2] usb: gadget: avoid warnings during configuration transitions

[PATCH v2 0/2] usb: gadget: avoid warnings during configuration transitions

[Keisuke Tsukuda]

Rapidly alternating SET_CONFIGURATION requests can overtake the
mass-storage function's asynchronous configuration work. This exposes two
states that are handled safely but currently produce kernel warnings: a
delayed-status completion after reset_config() cleared its counter, and a
class request while common->fsg is not installed.

The first patch keeps the obsolete completion as a dynamic-debug
diagnostic. The second avoids the warning only in fsg_setup(), where the
request is already rejected with -EOPNOTSUPP; warnings in other internal
f_mass_storage paths remain unchanged.

Both reports reproduce on an ARM64 Ubuntu 6.8 VM using dummy_hcd. With both
patches loaded, five 10-second, four-thread runs produced no WARNING, BUG,
or Oops. In a separate run, a kprobe observed five calls to
usb_composite_setup_continue() with delayed_status == 0 while the target
warning remained absent.

syzbot tested the v1 code on usb-testing commit
edc1518454f6439e50a9220e9a3ba09044ea8d8b and reported OK after a
50-minute run:

https://syzkaller.appspot.com/bug?extid=a83a5a1ba9ff57935171

Changes in v2:
- Add a comment in fsg_setup() explaining why fsg_is_set() must not be
  used for this check, as requested by Alan Stern.
- No executable code changes; patch 1 is unchanged.

Keisuke Tsukuda (2):
  usb: gadget: composite: avoid warning on aborted delayed status
  usb: gadget: f_mass_storage: ignore class requests while inactive

 drivers/usb/gadget/composite.c               | 2 +-
 drivers/usb/gadget/function/f_mass_storage.c | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

-- 
2.50.1 (Apple Git-155)

[PATCH v2 1/2] usb: gadget: composite: avoid warning on aborted delayed status

[Keisuke Tsukuda]

A SET_CONFIGURATION request that disables the current configuration, or a
disconnect, can abort a control transfer whose status stage was delayed by
a function driver. The asynchronous function work can nevertheless finish
later and call usb_composite_setup_continue() after reset_config() has
cleared delayed_status.

This is an expected consequence of aborting the old control transfer, and
does not require a kernel warning. Keep the diagnostic available under
dynamic debug and ignore the obsolete completion as before.

Fixes: 2bac51a1827a ("usb: gadget: composite: reset delayed_status on reset_config")
Reported-by: syzbot+a83a5a1ba9ff57935171@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a83a5a1ba9ff57935171
Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
---
 drivers/usb/gadget/composite.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index df39e34..1b22381 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2740,7 +2740,7 @@ void usb_composite_setup_continue(struct usb_composite_dev *cdev)
 	spin_lock_irqsave(&cdev->lock, flags);
 
 	if (cdev->delayed_status == 0) {
-		WARN(cdev, "%s: Unexpected call\n", __func__);
+		DBG(cdev, "%s: Ignoring obsolete call\n", __func__);
 
 	} else if (--cdev->delayed_status == 0) {
 		DBG(cdev, "%s: Completing delayed status\n", __func__);
-- 
2.50.1 (Apple Git-155)

[PATCH v2 2/2] usb: gadget: f_mass_storage: ignore class requests while inactive

[Keisuke Tsukuda]

SET_CONFIGURATION is handled asynchronously by the mass-storage thread.
A class request can arrive after the composite core selects the function
but before the thread installs common->fsg, or while the function is being
disabled.

fsg_setup() already rejects this state with -EOPNOTSUPP, but checking it
through fsg_is_set() also emits a warning. Check the active function
directly so normal requests during a configuration transition are rejected
without hiding fsg_is_set() warnings from other internal paths.

Fixes: 8876f5e7d3b2 ("USB: gadget: f_mass_storage: added eject callback")
Reported-by: syzbot+d31109047baed8f3b590@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d31109047baed8f3b590
Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
---
 drivers/usb/gadget/function/f_mass_storage.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index a50743c..e80ff0b 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -463,7 +463,12 @@ static int fsg_setup(struct usb_function *f,
 	u16			w_value = le16_to_cpu(ctrl->wValue);
 	u16			w_length = le16_to_cpu(ctrl->wLength);
 
-	if (!fsg_is_set(fsg->common))
+	/*
+	 * fsg_is_set() warns when common->fsg is NULL, but that can happen
+	 * normally while a configuration change installs or removes the active
+	 * function.
+	 */
+	if (!fsg->common->fsg)
 		return -EOPNOTSUPP;
 
 	++fsg->common->ep0_req_tag;	/* Record arrival of a new request */
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v2 2/2] usb: gadget: f_mass_storage: ignore class requests while inactive

[Alan Stern]

On Tue, Sep 08, 2026 at 08:33:54PM +0000, Keisuke Tsukuda wrote:
> SET_CONFIGURATION is handled asynchronously by the mass-storage thread.
> A class request can arrive after the composite core selects the function
> but before the thread installs common->fsg, or while the function is being
> disabled.
> 
> fsg_setup() already rejects this state with -EOPNOTSUPP, but checking it
> through fsg_is_set() also emits a warning. Check the active function
> directly so normal requests during a configuration transition are rejected
> without hiding fsg_is_set() warnings from other internal paths.
> 
> Fixes: 8876f5e7d3b2 ("USB: gadget: f_mass_storage: added eject callback")
> Reported-by: syzbot+d31109047baed8f3b590@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d31109047baed8f3b590
> Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
> ---

Acked-by: Alan Stern <stern@rowland.harvard.edu>

>  drivers/usb/gadget/function/f_mass_storage.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
> index a50743c..e80ff0b 100644
> --- a/drivers/usb/gadget/function/f_mass_storage.c
> +++ b/drivers/usb/gadget/function/f_mass_storage.c
> @@ -463,7 +463,12 @@ static int fsg_setup(struct usb_function *f,
>  	u16			w_value = le16_to_cpu(ctrl->wValue);
>  	u16			w_length = le16_to_cpu(ctrl->wLength);
>  
> -	if (!fsg_is_set(fsg->common))
> +	/*
> +	 * fsg_is_set() warns when common->fsg is NULL, but that can happen
> +	 * normally while a configuration change installs or removes the active
> +	 * function.
> +	 */
> +	if (!fsg->common->fsg)
>  		return -EOPNOTSUPP;
>  
>  	++fsg->common->ep0_req_tag;	/* Record arrival of a new request */
> -- 
> 2.50.1 (Apple Git-155)
>