Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)

[syzbot <syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com>]

> On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote:
>> Hello,
>> 
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> INFO: task hung in usb_bulk_msg
>
> Okay, most likely the reason for the hang is that the count is 0.  But 
> that doesn't explain everything.  Let's get more info.
>
> Alan Stern
>
> #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951

"#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address.

>
> ---
>  drivers/usb/class/usbtmc.c         |    7 +++----
>  drivers/usb/gadget/udc/dummy_hcd.c |   11 +++++++++--
>  2 files changed, 12 insertions(+), 6 deletions(-)
>
> Index: usb-devel/drivers/usb/class/usbtmc.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/class/usbtmc.c
> +++ usb-devel/drivers/usb/class/usbtmc.c
> @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
>  		data->bTag++;
>  
>  	kfree(buffer);
> -	if (retval < 0)
>  		dev_err(&data->intf->dev, "%s returned %d\n",
>  			__func__, retval);
>  
> @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
>  	if (count > INT_MAX)
>  		count = INT_MAX;
>  
> -	dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
> +	dev_info(dev, "%s(count:%zu)\n", __func__, count);
>  
>  	retval = send_request_dev_dep_msg_in(file_data, count);
>  
> @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
>  			      buffer, bufsize, &actual,
>  			      file_data->timeout);
>  
> -	dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
> +	dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
>  		__func__, retval, actual);
>  
>  	/* Store bTag (in case we need to abort) */
> @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
>  
>  	file_data->bmTransferAttributes = buffer[8];
>  
> -	dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
> +	dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
>  		n_characters, buffer[8]);
>  
>  	if (n_characters > remaining) {
> Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
>  	ep = usb_ep_to_dummy_ep(_ep);
>  	dum = ep_to_dummy(ep);
>  
> -	if (!dum->driver)
> +	if (!dum->driver) {
> +		dev_info(udc_dev(dum), "Got dequeue, no driver\n");
>  		return -ESHUTDOWN;
> +	}
> +	dev_info(udc_dev(dum),
> +			"dequeuing req %p from %s, len %d buf %p\n",
> +			req, _ep->name, _req->length, _req->buf);
>  
>  	spin_lock_irqsave(&dum->lock, flags);
>  	list_for_each_entry(iter, &ep->queue, queue) {
> @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
>  	}
>  
>  	if (retval == 0) {
> -		dev_dbg(udc_dev(dum),
> +		dev_info(udc_dev(dum),
>  				"dequeued req %p from %s, len %d buf %p\n",
>  				req, _ep->name, _req->length, _req->buf);
>  		spin_unlock(&dum->lock);
>  		usb_gadget_giveback_request(_ep, _req);
>  		spin_lock(&dum->lock);
> +	} else {
> +		dev_info(udc_dev(dum), "request not found\n");
>  	}
>  	spin_unlock_irqrestore(&dum->lock, flags);
>  	return retval;