* [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
@ 2026-02-08 6:34 syzbot
2026-02-08 8:55 ` Hillf Danton
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 6:34 UTC (permalink / raw)
To: anna-maria, frederic, linux-kernel, linux-usb, syzkaller-bugs,
tglx
Hello,
syzbot found the following issue on:
HEAD commit: da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142fab22580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/36cc3979cfa9/disk-da87d45b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8b9c4e01e1ee/vmlinux-da87d45b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/071303491de6/bzImage-da87d45b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
INFO: task syz.3.17:3963 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:27256 pid:3963 tgid:3963 ppid:3514 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
usbtmc_read+0x5f4/0x10b0 drivers/usb/class/usbtmc.c:1409
vfs_read+0x1e4/0xb30 fs/read_write.c:570
ksys_read+0x12a/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2b159faeb9
RSP: 002b:00007ffc49719d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f2b15c75fa0 RCX: 00007f2b159faeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f2b15a68c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2b15c75fac R14: 00007f2b15c75fa0 R15: 00007f2b15c75fa0
</TASK>
Showing all locks held in the system:
6 locks held by kworker/0:0/9:
#0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:1/38:
#0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90000287ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
2 locks held by kworker/u8:10/1609:
#0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900022dfca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
2 locks held by kworker/u8:13/2771:
#0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000406fca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
3 locks held by kworker/0:2/2820:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900041afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by getty/2925:
#0: ffff88811277a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
1 lock held by syz.3.17/3963:
#0: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x154/0x10b0 drivers/usb/class/usbtmc.c:1395
2 locks held by syz.4.18/4418:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
#1: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
1 lock held by syz.5.19/4873:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/1:3/4877:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006717ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.6.20/5329:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
6 locks held by kworker/0:3/5332:
#0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006e57ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
3 locks held by kworker/1:4/5738:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90005bafca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.7.21/5786:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
2 locks held by modprobe/5990:
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5991 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline]
RIP: 0010:__lock_acquire+0x341/0x2630 kernel/locking/lockdep.c:5187
Code: 38 c7 44 0f 47 f8 80 be c6 00 00 00 02 44 0f 44 f8 41 83 c6 01 48 83 c3 28 44 3b b5 a0 0a 00 00 0f 8d b2 00 00 00 0f b7 43 20 <66> 25 ff 1f 0f b7 c0 48 0f a3 05 10 d5 42 0d 72 a9 44 8b 1d 27 81
RSP: 0000:ffffc9000411f8a0 EFLAGS: 00000006
RAX: 00000000000083c5 RBX: ffff888116cc6268 RCX: 0000000000000005
RDX: 0000000000000001 RSI: ffff888116cc6240 RDI: 0000000000000000
RBP: ffff888116cc57c0 R08: 0000000000000000 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888116cc6330
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005
FS: 00007feb72295c80(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feb724d4b45 CR3: 0000000122c10000 CR4: 00000000003506f0
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:867 [inline]
page_table_check_set+0x2d3/0xa10 mm/page_table_check.c:112
__page_table_check_ptes_set+0x1db/0x230 mm/page_table_check.c:212
page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
set_ptes include/linux/pgtable.h:292 [inline]
set_pte_range+0x54f/0x630 mm/memory.c:5483
filemap_map_order0_folio mm/filemap.c:3856 [inline]
filemap_map_pages+0x91f/0x1df0 mm/filemap.c:3921
do_fault_around mm/memory.c:5713 [inline]
do_read_fault mm/memory.c:5746 [inline]
do_fault mm/memory.c:5889 [inline]
do_pte_missing mm/memory.c:4401 [inline]
handle_pte_fault mm/memory.c:6273 [inline]
__handle_mm_fault+0x1e8c/0x2d30 mm/memory.c:6411
handle_mm_fault+0x36d/0xa20 mm/memory.c:6580
do_user_addr_fault+0x5ae/0x11d0 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x66/0xc0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7feb723976c0
Code: 48 89 ef e8 b2 ec fe ff 85 c0 75 de 49 8b 47 08 80 38 2f 48 89 44 24 08 0f 85 8c 01 00 00 48 63 44 24 30 48 8d 15 80 d4 13 00 <0f> b6 1c 02 48 89 c7 48 8d 05 92 d4 13 00 48 01 c3 e8 ea e4 ff ff
RSP: 002b:00007ffc4877cef0 EFLAGS: 00010246
RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00007feb724d4b40 RSI: 0000000000000000 RDI: 00007feb725309e0
RBP: 00007feb724eec96 R08: 00007feb725309e0 R09: 0000000000000000
R10: 000000000000006c R11: 0000000000000217 R12: 00007feb724ef1e4
R13: ffffffffffffff88 R14: 0000000000000002 R15: 0000000000000000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 21+ messages in thread* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 6:34 [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) syzbot @ 2026-02-08 8:55 ` Hillf Danton 2026-02-08 14:47 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: Hillf Danton @ 2026-02-08 8:55 UTC (permalink / raw) To: syzbot Cc: Michal Pecio, Ben Greear, Oliver Neukum, Alan Stern, linux-kernel, linux-usb, syzkaller-bugs > Date: Sat, 07 Feb 2026 22:34:31 -0800 > Hello, > > syzbot found the following issue on: > > HEAD commit: da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m.. > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 > dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142fab22580000 > If the hung can be reproduced with PREEMPT(full) instead of (voluntary), this is a better case for spotting the reason why the underlying hardware failed to response within two minutes. > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/36cc3979cfa9/disk-da87d45b.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/8b9c4e01e1ee/vmlinux-da87d45b.xz > kernel image: https://storage.googleapis.com/syzbot-assets/071303491de6/bzImage-da87d45b.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com > > INFO: task syz.3.17:3963 blocked for more than 143 seconds. > Not tainted syzkaller #0 > "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. > task:syz.3.17 state:D stack:27256 pid:3963 tgid:3963 ppid:3514 task_flags:0x400040 flags:0x00080002 > Call Trace: > <TASK> > context_switch kernel/sched/core.c:5260 [inline] > __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 > __schedule_loop kernel/sched/core.c:6949 [inline] > schedule+0xdd/0x390 kernel/sched/core.c:6964 > schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 > do_wait_for_common kernel/sched/completion.c:100 [inline] > __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 > usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64 > usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388 > send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] > usbtmc_read+0x5f4/0x10b0 drivers/usb/class/usbtmc.c:1409 > vfs_read+0x1e4/0xb30 fs/read_write.c:570 > ksys_read+0x12a/0x250 fs/read_write.c:715 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > RIP: 0033:0x7f2b159faeb9 > RSP: 002b:00007ffc49719d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 > RAX: ffffffffffffffda RBX: 00007f2b15c75fa0 RCX: 00007f2b159faeb9 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 > RBP: 00007f2b15a68c1f R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 00007f2b15c75fac R14: 00007f2b15c75fa0 R15: 00007f2b15c75fa0 > </TASK> > > Showing all locks held in the system: > 6 locks held by kworker/0:0/9: > #0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 > #3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 > #4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 > #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 > 1 lock held by khungtaskd/30: > #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] > #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] > #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 > 6 locks held by kworker/1:1/38: > #0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc90000287ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 > #3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 > #4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 > #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 > 2 locks held by kworker/u8:10/1609: > #0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc900022dfca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > 2 locks held by kworker/u8:13/2771: > #0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc9000406fca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > 3 locks held by kworker/0:2/2820: > #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc900041afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] > #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 > 2 locks held by getty/2925: > #0: ffff88811277a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 > #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 > 1 lock held by syz.3.17/3963: > #0: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x154/0x10b0 drivers/usb/class/usbtmc.c:1395 > 2 locks held by syz.4.18/4418: > #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 > #1: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189 > 1 lock held by syz.5.19/4873: > #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 > 3 locks held by kworker/1:3/4877: > #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc90006717ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] > #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 > 1 lock held by syz.6.20/5329: > #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 > 6 locks held by kworker/0:3/5332: > #0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc90006e57ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 > #3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 > #4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 > #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 > 3 locks held by kworker/1:4/5738: > #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 > #1: ffffc90005bafca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 > #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] > #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] > #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 > 1 lock held by syz.7.21/5786: > #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 > 2 locks held by modprobe/5990: > > ============================================= > > NMI backtrace for cpu 1 > CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:94 [inline] > dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 > nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 > nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 > trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] > __sys_info lib/sys_info.c:157 [inline] > sys_info+0x141/0x190 lib/sys_info.c:165 > check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] > watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 > kthread+0x3b3/0x730 kernel/kthread.c:463 > ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 > </TASK> > Sending NMI from CPU 1 to CPUs 0: > NMI backtrace for cpu 0 > CPU: 0 UID: 0 PID: 5991 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 > RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline] > RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline] > RIP: 0010:__lock_acquire+0x341/0x2630 kernel/locking/lockdep.c:5187 > Code: 38 c7 44 0f 47 f8 80 be c6 00 00 00 02 44 0f 44 f8 41 83 c6 01 48 83 c3 28 44 3b b5 a0 0a 00 00 0f 8d b2 00 00 00 0f b7 43 20 <66> 25 ff 1f 0f b7 c0 48 0f a3 05 10 d5 42 0d 72 a9 44 8b 1d 27 81 > RSP: 0000:ffffc9000411f8a0 EFLAGS: 00000006 > RAX: 00000000000083c5 RBX: ffff888116cc6268 RCX: 0000000000000005 > RDX: 0000000000000001 RSI: ffff888116cc6240 RDI: 0000000000000000 > RBP: ffff888116cc57c0 R08: 0000000000000000 R09: 0000000000000007 > R10: 0000000000000005 R11: 0000000000000000 R12: ffff888116cc6330 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005 > FS: 00007feb72295c80(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007feb724d4b45 CR3: 0000000122c10000 CR4: 00000000003506f0 > Call Trace: > <TASK> > lock_acquire kernel/locking/lockdep.c:5868 [inline] > lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825 > rcu_lock_acquire include/linux/rcupdate.h:331 [inline] > rcu_read_lock include/linux/rcupdate.h:867 [inline] > page_table_check_set+0x2d3/0xa10 mm/page_table_check.c:112 > __page_table_check_ptes_set+0x1db/0x230 mm/page_table_check.c:212 > page_table_check_ptes_set include/linux/page_table_check.h:76 [inline] > set_ptes include/linux/pgtable.h:292 [inline] > set_pte_range+0x54f/0x630 mm/memory.c:5483 > filemap_map_order0_folio mm/filemap.c:3856 [inline] > filemap_map_pages+0x91f/0x1df0 mm/filemap.c:3921 > do_fault_around mm/memory.c:5713 [inline] > do_read_fault mm/memory.c:5746 [inline] > do_fault mm/memory.c:5889 [inline] > do_pte_missing mm/memory.c:4401 [inline] > handle_pte_fault mm/memory.c:6273 [inline] > __handle_mm_fault+0x1e8c/0x2d30 mm/memory.c:6411 > handle_mm_fault+0x36d/0xa20 mm/memory.c:6580 > do_user_addr_fault+0x5ae/0x11d0 arch/x86/mm/fault.c:1336 > handle_page_fault arch/x86/mm/fault.c:1476 [inline] > exc_page_fault+0x66/0xc0 arch/x86/mm/fault.c:1532 > asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 > RIP: 0033:0x7feb723976c0 > Code: 48 89 ef e8 b2 ec fe ff 85 c0 75 de 49 8b 47 08 80 38 2f 48 89 44 24 08 0f 85 8c 01 00 00 48 63 44 24 30 48 8d 15 80 d4 13 00 <0f> b6 1c 02 48 89 c7 48 8d 05 92 d4 13 00 48 01 c3 e8 ea e4 ff ff > RSP: 002b:00007ffc4877cef0 EFLAGS: 00010246 > RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000 > RDX: 00007feb724d4b40 RSI: 0000000000000000 RDI: 00007feb725309e0 > RBP: 00007feb724eec96 R08: 00007feb725309e0 R09: 0000000000000000 > R10: 000000000000006c R11: 0000000000000217 R12: 00007feb724ef1e4 > R13: ffffffffffffff88 R14: 0000000000000002 R15: 0000000000000000 > </TASK> ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 8:55 ` Hillf Danton @ 2026-02-08 14:47 ` Alan Stern 2026-02-08 15:03 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-08 14:47 UTC (permalink / raw) To: Hillf Danton Cc: syzbot, Michal Pecio, Ben Greear, Oliver Neukum, linux-kernel, linux-usb, syzkaller-bugs On Sun, Feb 08, 2026 at 04:55:30PM +0800, Hillf Danton wrote: > > Date: Sat, 07 Feb 2026 22:34:31 -0800 > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m.. > > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > > console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 > > dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d > > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142fab22580000 > > > If the hung can be reproduced with PREEMPT(full) instead of (voluntary), this is > a better case for spotting the reason why the underlying hardware failed to > response within two minutes. What hardware are you talking about? This test doesn't involve any specific hardware. Let's get some diagnostics. Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 14:47 ` Alan Stern @ 2026-02-08 15:03 ` syzbot 2026-02-08 15:17 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-08 15:03 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in usb_bulk_msg INFO: task syz.3.17:4972 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.17 state:D stack:28120 pid:4972 tgid:4971 ppid:4522 task_flags:0x400040 flags:0x00080002 Call Trace: <TASK> context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64 usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408 vfs_read+0x1e4/0xb30 fs/read_write.c:570 ksys_read+0x12a/0x250 fs/read_write.c:715 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8ae743aeb9 RSP: 002b:00007f8ae729f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f8ae76b5fa0 RCX: 00007f8ae743aeb9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f8ae74a8c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8ae76b6038 R14: 00007f8ae76b5fa0 R15: 00007ffff317e338 </TASK> Showing all locks held in the system: 3 locks held by kworker/0:0/9: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000009fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 3 locks held by kworker/0:1/10: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900000afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 1 lock held by khungtaskd/30: #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 6 locks held by kworker/1:1/37: #0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90000277ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88811ffd8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88811ffd8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888117964160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888117964160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 6 locks held by kworker/1:2/1121: #0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90001c3fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88811e01c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88811e01c198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff88810cac4160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff88810cac4160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 6 locks held by kworker/0:2/2808: #0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000415fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888113946198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888113946198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888113be7160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888113be7160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 2 locks held by getty/2922: #0: ffff888115caa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 1 lock held by syz.3.17/4972: #0: ffff88810bf5e4d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1394 3 locks held by kworker/0:3/4975: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90001dffca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 2 locks held by syz.4.18/5429: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 #1: ffff88810bf5e4d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189 3 locks held by kworker/1:3/5432: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000424fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 1 lock held by syz.5.19/5886: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 1 lock held by syz.6.20/6344: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 6 locks held by kworker/0:4/6347: #0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90006c5fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888117210198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888117210198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888117211160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888117211160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by syz.7.21/6802: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 1 lock held by syz.8.22/7261: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:update_sd_lb_stats.constprop.0+0xa/0x3630 kernel/sched/fair.c:11084 Code: 04 24 e8 69 fa a0 ff 4c 8b 04 24 e9 76 f9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 00 00 00 00 fc ff df <41> 57 41 56 49 89 fe 41 55 41 54 55 53 48 81 ec a0 01 00 00 48 8d RSP: 0018:ffffc90000007968 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc90000007c30 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: ffffc900000079b8 RDI: ffffc90000007c30 RBP: 1ffff92000000f31 R08: 0000000000000000 R09: ffffed103eac485c R10: ffff8881f56242e7 R11: ffff888100ecd400 R12: ffff8881f56242d0 R13: ffffc90000007da8 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561ec5730d28 CR3: 00000001174aa000 CR4: 00000000003506f0 Call Trace: <IRQ> sched_balance_find_src_group+0x99/0xc70 kernel/sched/fair.c:11365 sched_balance_rq+0x7f0/0x33a0 kernel/sched/fair.c:11851 sched_balance_domains+0x46d/0xd40 kernel/sched/fair.c:12311 _nohz_idle_balance.isra.0+0x654/0x860 kernel/sched/fair.c:12743 handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0x8f/0xb0 arch/x86/kernel/smp.c:266 </IRQ> <TASK> asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:704 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82 Code: 3a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 b3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffffff89207e10 EFLAGS: 00000242 RAX: 0000000000161aa1 RBX: ffffffff8922eac0 RCX: ffffffff8753acd5 RDX: 0000000000000000 RSI: ffffffff88dec902 RDI: ffffffff878e97a0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed103eac66c5 R10: ffff8881f563362b R11: 0000000000000000 R12: fffffbfff1245d58 R13: 0000000000000000 R14: ffffffff8accd4d0 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:767 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x35b/0x4b0 kernel/sched/idle.c:332 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430 rest_init+0x251/0x260 init/main.c:757 start_kernel+0x475/0x480 init/main.c:1206 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x122/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x148 </TASK> Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=1099b65a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=13ac5402580000 ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 15:03 ` syzbot @ 2026-02-08 15:17 ` Alan Stern 2026-02-08 15:17 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-08 15:17 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > INFO: task hung in usb_bulk_msg Okay, most likely the reason for the hang is that the count is 0. But that doesn't explain everything. Let's get more info. Alan Stern #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 --- drivers/usb/class/usbtmc.c | 7 +++---- drivers/usb/gadget/udc/dummy_hcd.c | 11 +++++++++-- 2 files changed, 12 insertions(+), 6 deletions(-) Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * ep = usb_ep_to_dummy_ep(_ep); dum = ep_to_dummy(ep); - if (!dum->driver) + if (!dum->driver) { + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); return -ESHUTDOWN; + } + dev_info(udc_dev(dum), + "dequeuing req %p from %s, len %d buf %p\n", + req, _ep->name, _req->length, _req->buf); spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * } if (retval == 0) { - dev_dbg(udc_dev(dum), + dev_info(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); spin_lock(&dum->lock); + } else { + dev_info(udc_dev(dum), "request not found\n"); } spin_unlock_irqrestore(&dum->lock, flags); return retval; ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 15:17 ` Alan Stern @ 2026-02-08 15:17 ` syzbot 2026-02-08 15:19 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-08 15:17 UTC (permalink / raw) To: stern Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs > On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote: >> Hello, >> >> syzbot has tested the proposed patch but the reproducer is still triggering an issue: >> INFO: task hung in usb_bulk_msg > > Okay, most likely the reason for the hang is that the count is 0. But > that doesn't explain everything. Let's get more info. > > Alan Stern > > #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 "#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address. > > --- > drivers/usb/class/usbtmc.c | 7 +++---- > drivers/usb/gadget/udc/dummy_hcd.c | 11 +++++++++-- > 2 files changed, 12 insertions(+), 6 deletions(-) > > Index: usb-devel/drivers/usb/class/usbtmc.c > =================================================================== > --- usb-devel.orig/drivers/usb/class/usbtmc.c > +++ usb-devel/drivers/usb/class/usbtmc.c > @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s > data->bTag++; > > kfree(buffer); > - if (retval < 0) > dev_err(&data->intf->dev, "%s returned %d\n", > __func__, retval); > > @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * > if (count > INT_MAX) > count = INT_MAX; > > - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); > + dev_info(dev, "%s(count:%zu)\n", __func__, count); > > retval = send_request_dev_dep_msg_in(file_data, count); > > @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * > buffer, bufsize, &actual, > file_data->timeout); > > - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", > + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", > __func__, retval, actual); > > /* Store bTag (in case we need to abort) */ > @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * > > file_data->bmTransferAttributes = buffer[8]; > > - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", > + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", > n_characters, buffer[8]); > > if (n_characters > remaining) { > Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c > =================================================================== > --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c > +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c > @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * > ep = usb_ep_to_dummy_ep(_ep); > dum = ep_to_dummy(ep); > > - if (!dum->driver) > + if (!dum->driver) { > + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); > return -ESHUTDOWN; > + } > + dev_info(udc_dev(dum), > + "dequeuing req %p from %s, len %d buf %p\n", > + req, _ep->name, _req->length, _req->buf); > > spin_lock_irqsave(&dum->lock, flags); > list_for_each_entry(iter, &ep->queue, queue) { > @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * > } > > if (retval == 0) { > - dev_dbg(udc_dev(dum), > + dev_info(udc_dev(dum), > "dequeued req %p from %s, len %d buf %p\n", > req, _ep->name, _req->length, _req->buf); > spin_unlock(&dum->lock); > usb_gadget_giveback_request(_ep, _req); > spin_lock(&dum->lock); > + } else { > + dev_info(udc_dev(dum), "request not found\n"); > } > spin_unlock_irqrestore(&dum->lock, flags); > return retval; ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 15:17 ` syzbot @ 2026-02-08 15:19 ` Alan Stern 2026-02-08 15:50 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-08 15:19 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On Sun, Feb 08, 2026 at 07:17:53AM -0800, syzbot wrote: > > On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote: > >> Hello, > >> > >> syzbot has tested the proposed patch but the reproducer is still triggering an issue: > >> INFO: task hung in usb_bulk_msg > > > > Okay, most likely the reason for the hang is that the count is 0. But > > that doesn't explain everything. Let's get more info. > > > > Alan Stern > > > > #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 > > "#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address. Fix the typo... #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * ep = usb_ep_to_dummy_ep(_ep); dum = ep_to_dummy(ep); - if (!dum->driver) + if (!dum->driver) { + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); return -ESHUTDOWN; + } + dev_info(udc_dev(dum), + "dequeuing req %p from %s, len %d buf %p\n", + req, _ep->name, _req->length, _req->buf); spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * } if (retval == 0) { - dev_dbg(udc_dev(dum), + dev_info(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); spin_lock(&dum->lock); + } else { + dev_info(udc_dev(dum), "request not found\n"); } spin_unlock_irqrestore(&dum->lock, flags); return retval; ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 15:19 ` Alan Stern @ 2026-02-08 15:50 ` syzbot 2026-02-08 20:10 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-08 15:50 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in usb_bulk_msg INFO: task syz.3.17:4981 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002 Call Trace: <TASK> context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64 usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408 vfs_read+0x1e4/0xb30 fs/read_write.c:570 ksys_read+0x12a/0x250 fs/read_write.c:715 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fab75baaeb9 RSP: 002b:00007fab75a0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fab75e25fa0 RCX: 00007fab75baaeb9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007fab75c18c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fab75e26038 R14: 00007fab75e25fa0 R15: 00007ffcbc60e758 </TASK> Showing all locks held in the system: 3 locks held by kworker/1:0/23: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000018fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 1 lock held by khungtaskd/30: #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 6 locks held by kworker/1:1/38: #0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90000287ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88810529f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88810529f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff88810529e160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff88810529e160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 6 locks held by kworker/0:2/1069: #0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90001d6fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888117f24198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888117f24198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888117f21160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888117f21160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by klogd/2853: #0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:639 [inline] #0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1580 [inline] #0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1907 [inline] #0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2c5/0x3e50 kernel/sched/core.c:6772 2 locks held by getty/2928: #0: ffff8881163f10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 1 lock held by syz.3.17/4981: #0: ffff888120d3a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1394 2 locks held by syz.4.18/5437: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 #1: ffff888120d3a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189 6 locks held by kworker/1:3/5441: #0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000197fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff8881076c0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff8881076c0198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888104af0160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888104af0160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by syz.5.19/5896: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 3 locks held by kworker/0:3/5899: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90003dafca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 1 lock held by syz.6.20/6352: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 1 lock held by syz.7.21/6809: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 3 locks held by kworker/0:4/6813: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90006557ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 3 locks held by kworker/0:5/6814: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000659fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 6 locks held by kworker/1:4/6815: #0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900065afca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88810529d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88810529d198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888105285160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888105285160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by syz.8.22/7270: #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82 Code: 3a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 b3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffffff89207e10 EFLAGS: 00000246 RAX: 000000000015142d RBX: ffffffff8922eac0 RCX: ffffffff8753acd5 RDX: 0000000000000000 RSI: ffffffff88dec96c RDI: ffffffff878e97a0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed103eac66c5 R10: ffff8881f563362b R11: 0000000000000000 R12: fffffbfff1245d58 R13: 0000000000000000 R14: ffffffff8accd4d0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff97c59ce80 CR3: 000000011e9b8000 CR4: 00000000003506f0 Call Trace: <TASK> arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:767 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x35b/0x4b0 kernel/sched/idle.c:332 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430 rest_init+0x251/0x260 init/main.c:757 start_kernel+0x475/0x480 init/main.c:1206 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x122/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x148 </TASK> Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=172f065a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=1481e7fa580000 ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 15:50 ` syzbot @ 2026-02-08 20:10 ` Alan Stern 2026-02-08 20:10 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-08 20:10 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On Sun, Feb 08, 2026 at 07:50:03AM -0800, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > INFO: task hung in usb_bulk_msg > > INFO: task syz.3.17:4981 blocked for more than 143 seconds. > Not tainted syzkaller #0 > "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. > task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002 > Call Trace: > <TASK> > context_switch kernel/sched/core.c:5260 [inline] > __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 > __schedule_loop kernel/sched/core.c:6949 [inline] > schedule+0xdd/0x390 kernel/sched/core.c:6964 > schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 > do_wait_for_common kernel/sched/completion.c:100 [inline] > __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 > usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64 > usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388 > send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] > usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408 Unfortunately the log didn't contain any new useful information. Let's try looking farther back. Alan Stern #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * ep = usb_ep_to_dummy_ep(_ep); dum = ep_to_dummy(ep); - if (!dum->driver) + if (!dum->driver) { + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); return -ESHUTDOWN; + } + dev_info(udc_dev(dum), + "dequeuing req %p from %s, len %d buf %p\n", + req, _ep->name, _req->length, _req->buf); spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * } if (retval == 0) { - dev_dbg(udc_dev(dum), + dev_info(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); spin_lock(&dum->lock); + } else { + dev_info(udc_dev(dum), "request not found\n"); } spin_unlock_irqrestore(&dum->lock, flags); return retval; Index: usb-devel/drivers/usb/core/message.c =================================================================== --- usb-devel.orig/drivers/usb/core/message.c +++ usb-devel/drivers/usb/core/message.c @@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb urb->context = &ctx; urb->actual_length = 0; retval = usb_submit_urb(urb, GFP_NOIO); - if (unlikely(retval)) + if (unlikely(retval)) { + dev_info(&urb->dev->dev, "Submission failed on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); goto out; + } expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; if (!wait_for_completion_timeout(&ctx.done, expire)) { + dev_info(&urb->dev->dev, "Killing URB on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); + usb_kill_urb(urb); retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); - dev_dbg(&urb->dev->dev, + dev_info(&urb->dev->dev, "%s timed out on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc), ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 20:10 ` Alan Stern @ 2026-02-08 20:10 ` syzbot 2026-02-08 20:13 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-08 20:10 UTC (permalink / raw) To: stern Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs > On Sun, Feb 08, 2026 at 07:50:03AM -0800, syzbot wrote: >> Hello, >> >> syzbot has tested the proposed patch but the reproducer is still triggering an issue: >> INFO: task hung in usb_bulk_msg >> >> INFO: task syz.3.17:4981 blocked for more than 143 seconds. >> Not tainted syzkaller #0 >> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. >> task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002 >> Call Trace: >> <TASK> >> context_switch kernel/sched/core.c:5260 [inline] >> __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 >> __schedule_loop kernel/sched/core.c:6949 [inline] >> schedule+0xdd/0x390 kernel/sched/core.c:6964 >> schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 >> do_wait_for_common kernel/sched/completion.c:100 [inline] >> __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 >> usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64 >> usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388 >> send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] >> usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408 > > Unfortunately the log didn't contain any new useful information. Let's > try looking farther back. > > Alan Stern > > #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 "#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address. > > Index: usb-devel/drivers/usb/class/usbtmc.c > =================================================================== > --- usb-devel.orig/drivers/usb/class/usbtmc.c > +++ usb-devel/drivers/usb/class/usbtmc.c > @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s > data->bTag++; > > kfree(buffer); > - if (retval < 0) > dev_err(&data->intf->dev, "%s returned %d\n", > __func__, retval); > > @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * > if (count > INT_MAX) > count = INT_MAX; > > - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); > + dev_info(dev, "%s(count:%zu)\n", __func__, count); > > retval = send_request_dev_dep_msg_in(file_data, count); > > @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * > buffer, bufsize, &actual, > file_data->timeout); > > - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", > + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", > __func__, retval, actual); > > /* Store bTag (in case we need to abort) */ > @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * > > file_data->bmTransferAttributes = buffer[8]; > > - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", > + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", > n_characters, buffer[8]); > > if (n_characters > remaining) { > Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c > =================================================================== > --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c > +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c > @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * > ep = usb_ep_to_dummy_ep(_ep); > dum = ep_to_dummy(ep); > > - if (!dum->driver) > + if (!dum->driver) { > + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); > return -ESHUTDOWN; > + } > + dev_info(udc_dev(dum), > + "dequeuing req %p from %s, len %d buf %p\n", > + req, _ep->name, _req->length, _req->buf); > > spin_lock_irqsave(&dum->lock, flags); > list_for_each_entry(iter, &ep->queue, queue) { > @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * > } > > if (retval == 0) { > - dev_dbg(udc_dev(dum), > + dev_info(udc_dev(dum), > "dequeued req %p from %s, len %d buf %p\n", > req, _ep->name, _req->length, _req->buf); > spin_unlock(&dum->lock); > usb_gadget_giveback_request(_ep, _req); > spin_lock(&dum->lock); > + } else { > + dev_info(udc_dev(dum), "request not found\n"); > } > spin_unlock_irqrestore(&dum->lock, flags); > return retval; > Index: usb-devel/drivers/usb/core/message.c > =================================================================== > --- usb-devel.orig/drivers/usb/core/message.c > +++ usb-devel/drivers/usb/core/message.c > @@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb > urb->context = &ctx; > urb->actual_length = 0; > retval = usb_submit_urb(urb, GFP_NOIO); > - if (unlikely(retval)) > + if (unlikely(retval)) { > + dev_info(&urb->dev->dev, "Submission failed on ep%d\n", > + usb_endpoint_num(&urb->ep->desc)); > goto out; > + } > > expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; > if (!wait_for_completion_timeout(&ctx.done, expire)) { > + dev_info(&urb->dev->dev, "Killing URB on ep%d\n", > + usb_endpoint_num(&urb->ep->desc)); > + > usb_kill_urb(urb); > retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); > > - dev_dbg(&urb->dev->dev, > + dev_info(&urb->dev->dev, > "%s timed out on ep%d%s len=%u/%u\n", > current->comm, > usb_endpoint_num(&urb->ep->desc), > > ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 20:10 ` syzbot @ 2026-02-08 20:13 ` Alan Stern 2026-02-08 20:34 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-08 20:13 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs Can't believe I made the same mistake again. This time for sure! Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * ep = usb_ep_to_dummy_ep(_ep); dum = ep_to_dummy(ep); - if (!dum->driver) + if (!dum->driver) { + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); return -ESHUTDOWN; + } + dev_info(udc_dev(dum), + "dequeuing req %p from %s, len %d buf %p\n", + req, _ep->name, _req->length, _req->buf); spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * } if (retval == 0) { - dev_dbg(udc_dev(dum), + dev_info(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); spin_lock(&dum->lock); + } else { + dev_info(udc_dev(dum), "request not found\n"); } spin_unlock_irqrestore(&dum->lock, flags); return retval; Index: usb-devel/drivers/usb/core/message.c =================================================================== --- usb-devel.orig/drivers/usb/core/message.c +++ usb-devel/drivers/usb/core/message.c @@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb urb->context = &ctx; urb->actual_length = 0; retval = usb_submit_urb(urb, GFP_NOIO); - if (unlikely(retval)) + if (unlikely(retval)) { + dev_info(&urb->dev->dev, "Submission failed on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); goto out; + } expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; if (!wait_for_completion_timeout(&ctx.done, expire)) { + dev_info(&urb->dev->dev, "Killing URB on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); + usb_kill_urb(urb); retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); - dev_dbg(&urb->dev->dev, + dev_info(&urb->dev->dev, "%s timed out on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc), ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 20:13 ` Alan Stern @ 2026-02-08 20:34 ` syzbot 2026-02-08 21:32 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-08 20:34 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in usb_bulk_msg INFO: task syz.3.17:4978 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.17 state:D stack:27432 pid:4978 tgid:4976 ppid:4527 task_flags:0x400040 flags:0x00080002 Call Trace: <TASK> context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 usb_start_wait_urb+0x157/0x270 drivers/usb/core/message.c:67 usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:394 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408 vfs_read+0x1e4/0xb30 fs/read_write.c:570 ksys_read+0x12a/0x250 fs/read_write.c:715 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7eff6393aeb9 RSP: 002b:00007eff63797028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007eff63bb5fa0 RCX: 00007eff6393aeb9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007eff639a8c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007eff63bb6038 R14: 00007eff63bb5fa0 R15: 00007ffcb37c7118 </TASK> Showing all locks held in the system: 6 locks held by kworker/0:0/9: #0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888117bc9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888117bc9198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff88811edf8160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff88811edf8160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 6 locks held by kworker/1:0/23: #0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000018fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88811d544198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88811d544198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff88811d545160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff88811d545160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by khungtaskd/30: #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/1:2/700: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90001a2fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 2 locks held by getty/2922: #0: ffff8881012830a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 6 locks held by kworker/0:2/2989: #0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900017dfca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88810f39e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88810f39e198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888105b6d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888105b6d160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 3 locks held by kworker/1:3/3481: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000183fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 1 lock held by syz.3.17/4978: #0: ffff88811db8bcd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1394 2 locks held by syz.4.18/5433: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 #1: ffff88811db8bcd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189 1 lock held by syz.5.19/5891: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 6 locks held by kworker/0:3/6183: #0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90004f6fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888117bce198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888117bce198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888117bca160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888117bca160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by syz.6.20/6348: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 1 lock held by syz.7.21/6805: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 3 locks held by kworker/0:4/6809: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90006a77ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 1 lock held by syz.8.22/7265: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 3 locks held by kworker/1:5/7269: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90007cffca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:37 [inline] RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:139 [inline] RIP: 0010:wrmsrq arch/x86/include/asm/msr.h:199 [inline] RIP: 0010:native_apic_msr_write arch/x86/include/asm/apic.h:212 [inline] RIP: 0010:native_apic_msr_write+0x28/0x40 arch/x86/include/asm/apic.h:206 Code: 90 90 f3 0f 1e fa 8d 87 30 ff ff ff 83 e0 ef 74 20 89 f8 83 e0 ef 83 f8 20 74 16 c1 ef 04 31 d2 89 f0 8d 8f 00 08 00 00 0f 30 <66> 90 e9 11 a9 e8 05 e9 0c a9 e8 05 89 f6 31 d2 89 cf e9 a1 af 65 RSP: 0018:ffffc90000007ec8 EFLAGS: 00000046 RAX: 0000000002db1b93 RBX: ffff8881f5623d00 RCX: 0000000000000838 RDX: 0000000000000000 RSI: 0000000002db1b93 RDI: 0000000000000038 RBP: 0000000002db1b93 R08: 0000000000000005 R09: 000000000000003f R10: 0000000000000020 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000020 R15: ffff8881f56280c0 FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fae4eb19e80 CR3: 000000011c80c000 CR4: 00000000003506f0 Call Trace: <IRQ> apic_write arch/x86/include/asm/apic.h:409 [inline] lapic_next_event+0x10/0x20 arch/x86/kernel/apic/apic.c:418 clockevents_program_event+0x26e/0x360 kernel/time/clockevents.c:334 tick_program_event+0xa9/0x140 kernel/time/tick-oneshot.c:48 hrtimer_interrupt+0x3e9/0x8c0 kernel/time/hrtimer.c:1916 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline] __sysvec_apic_timer_interrupt+0x109/0x3c0 arch/x86/kernel/apic/apic.c:1062 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x8a/0xb0 arch/x86/kernel/apic/apic.c:1056 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82 Code: 4a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 c3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffffff89207e10 EFLAGS: 00000246 RAX: 0000000000e57769 RBX: ffffffff8922eac0 RCX: ffffffff87539cd5 RDX: 0000000000000000 RSI: ffffffff88dec98e RDI: ffffffff878e97a0 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed103eac66c5 R10: ffff8881f563362b R11: 0000000000000000 R12: fffffbfff1245d58 R13: 0000000000000000 R14: ffffffff8accd4d0 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:767 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x35b/0x4b0 kernel/sched/idle.c:332 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430 rest_init+0x251/0x260 init/main.c:757 start_kernel+0x475/0x480 init/main.c:1206 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x122/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x148 </TASK> Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=15a95402580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=11095402580000 ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 20:34 ` syzbot @ 2026-02-08 21:32 ` Alan Stern 2026-02-08 21:53 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-08 21:32 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On Sun, Feb 08, 2026 at 12:34:02PM -0800, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > INFO: task hung in usb_bulk_msg Okay, I've got an idea about what's going wrong. There's even a comment warning about this in the source code. Let's see if the idea is right. Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1347,6 +1347,8 @@ static int send_request_dev_dep_msg_in(s buffer[11] = 0; /* Reserved */ /* Send bulk URB */ + dev_info(&data->intf->dev, "Timeout set to %d\n", + file_data->timeout); retval = usb_bulk_msg(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), @@ -1362,7 +1364,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1405,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1426,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1471,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * ep = usb_ep_to_dummy_ep(_ep); dum = ep_to_dummy(ep); - if (!dum->driver) + if (!dum->driver) { + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); return -ESHUTDOWN; + } + dev_info(udc_dev(dum), + "dequeuing req %p from %s, len %d buf %p\n", + req, _ep->name, _req->length, _req->buf); spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * } if (retval == 0) { - dev_dbg(udc_dev(dum), + dev_info(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); spin_lock(&dum->lock); + } else { + dev_info(udc_dev(dum), "request not found\n"); } spin_unlock_irqrestore(&dum->lock, flags); return retval; Index: usb-devel/drivers/usb/core/message.c =================================================================== --- usb-devel.orig/drivers/usb/core/message.c +++ usb-devel/drivers/usb/core/message.c @@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb urb->context = &ctx; urb->actual_length = 0; retval = usb_submit_urb(urb, GFP_NOIO); - if (unlikely(retval)) + if (unlikely(retval)) { + dev_info(&urb->dev->dev, "Submission failed on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); goto out; + } expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; if (!wait_for_completion_timeout(&ctx.done, expire)) { + dev_info(&urb->dev->dev, "Killing URB on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); + usb_kill_urb(urb); retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); - dev_dbg(&urb->dev->dev, + dev_info(&urb->dev->dev, "%s timed out on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc), ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 21:32 ` Alan Stern @ 2026-02-08 21:53 ` syzbot 2026-02-09 1:26 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-08 21:53 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in usb_bulk_msg INFO: task syz.3.17:4974 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.17 state:D stack:27384 pid:4974 tgid:4973 ppid:4524 task_flags:0x400040 flags:0x00080002 Call Trace: <TASK> context_switch kernel/sched/core.c:5260 [inline] __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 usb_start_wait_urb+0x157/0x270 drivers/usb/core/message.c:67 usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:394 send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1352 [inline] usbtmc_read.cold+0x59f/0x1075 drivers/usb/class/usbtmc.c:1410 vfs_read+0x1e4/0xb30 fs/read_write.c:570 ksys_read+0x12a/0x250 fs/read_write.c:715 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbce20eaeb9 RSP: 002b:00007fbce1f4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fbce2365fa0 RCX: 00007fbce20eaeb9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007fbce2158c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fbce2366038 R14: 00007fbce2365fa0 R15: 00007ffc4a036e78 </TASK> Showing all locks held in the system: 3 locks held by kworker/0:0/9: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000009fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 3 locks held by kworker/0:1/10: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900000afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 6 locks held by kworker/1:0/23: #0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000018fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88811b56e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88811b56e198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888106aed160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888106aed160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by khungtaskd/30: #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 6 locks held by kworker/1:1/65: #0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900005b7ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888113911198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888113911198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888113910160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888113910160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 3 locks held by kworker/1:2/1122: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90001dcfca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 2 locks held by getty/2924: #0: ffff88811286f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 6 locks held by kworker/0:2/3000: #0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900018efca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff88811bd0a198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88811bd0a198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888117864160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888117864160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by syz.3.17/4974: #0: ffff88811d6230d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1396 2 locks held by syz.4.18/5430: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 #1: ffff88811d6230d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189 1 lock held by syz.5.19/5887: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 1 lock held by syz.6.20/6345: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 6 locks held by kworker/1:4/6349: #0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900051cfca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899 #3: ffff888117993198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff888117993198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #4: ffff888104ae9160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888104ae9160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006 #5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134 1 lock held by syz.7.21/6804: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 1 lock held by syz.8.22/7262: #0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38 3 locks held by kworker/1:6/7266: #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900077cfca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline] #2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:__update_blocked_fair kernel/sched/fair.c:9868 [inline] RIP: 0010:sched_balance_update_blocked_averages+0x456/0x1dd0 kernel/sched/fair.c:9963 Code: 00 00 49 8b 9e 98 01 00 00 48 89 84 24 90 00 00 00 0f 85 fb 07 00 00 48 8d bb 28 01 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 <0f> 85 84 0f 00 00 48 8b 44 24 70 48 03 83 28 01 00 00 48 89 c3 48 RSP: 0018:ffffc900001a8d50 EFLAGS: 00000046 RAX: 1ffffffff19a16dd RBX: ffffffff8cd0b5c0 RCX: ffffffff81897273 RDX: 1ffff1103eae7263 RSI: ffffffff878e9720 RDI: ffffffff8cd0b6e8 RBP: ffffc900001a8e20 R08: ffff8881f5739318 R09: fffffbfff1599a9a R10: ffffffff8accd4d7 R11: ffff8881f5739208 R12: dffffc0000000000 R13: ffff8881f5739998 R14: ffff8881f5739180 R15: ffff8881f57392f8 FS: 0000000000000000(0000) GS:ffff888268a6a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3354aae80 CR3: 000000011736a000 CR4: 00000000003506f0 Call Trace: <IRQ> update_nohz_stats kernel/sched/fair.c:12661 [inline] _nohz_idle_balance.isra.0+0x667/0x860 kernel/sched/fair.c:12729 handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline] sysvec_call_function_single+0x8f/0xb0 arch/x86/kernel/smp.c:266 </IRQ> <TASK> asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:704 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82 Code: 4a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 c3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc9000013fe00 EFLAGS: 00000246 RAX: 0000000000df6769 RBX: ffff888101ecba80 RCX: ffffffff87539cd5 RDX: 0000000000000000 RSI: ffffffff88dec9ce RDI: ffffffff878e97a0 RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed103eae66c5 R10: ffff8881f573362b R11: 0000000000000000 R12: ffffed10203d9750 R13: 0000000000000001 R14: ffffffff8accd4d0 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:767 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x35b/0x4b0 kernel/sched/idle.c:332 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x148 </TASK> Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=11b0765a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=135aaa52580000 ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-08 21:53 ` syzbot @ 2026-02-09 1:26 ` Alan Stern 2026-02-09 1:46 ` syzbot 2026-02-09 10:03 ` Oliver Neukum 0 siblings, 2 replies; 21+ messages in thread From: Alan Stern @ 2026-02-09 1:26 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On Sun, Feb 08, 2026 at 01:53:02PM -0800, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > INFO: task hung in usb_bulk_msg All right, that clinches it. There's no problem with hardware or a device driver; the problem is that a kernel thread is stuck in an uninterruptible wait state for a very long time. Hopefully this patch will prevent that from happening. Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/core/message.c =================================================================== --- usb-devel.orig/drivers/usb/core/message.c +++ usb-devel/drivers/usb/core/message.c @@ -25,6 +25,8 @@ #include "usb.h" +#define MAX_UNINTERRUPTIBLE_TIMEOUT_MS 60000 + static void cancel_async_set_config(struct usb_device *udev); struct api_context { @@ -42,16 +44,16 @@ static void usb_api_blocking_completion( /* - * Starts urb and waits for completion or timeout. Note that this call - * is NOT interruptible. Many device driver i/o requests should be - * interruptible and therefore these drivers should implement their - * own interruptible routines. + * Starts urb and waits for completion or timeout. Timeout lengths <= 0 + * are taken to be as long as possible. + * The wait is NOT interruptible if the timeout period is no longer than + * MAX_UNINTERRUPTIBLE_TIMEOUT_MS, otherwise it IS interruptible. */ static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length) { struct api_context ctx; unsigned long expire; - int retval; + int rc, retval; init_completion(&ctx.done); urb->context = &ctx; @@ -60,8 +62,14 @@ static int usb_start_wait_urb(struct urb if (unlikely(retval)) goto out; - expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; - if (!wait_for_completion_timeout(&ctx.done, expire)) { + expire = (timeout > 0) ? msecs_to_jiffies(timeout) : + MAX_SCHEDULE_TIMEOUT; + if (expire <= msecs_to_jiffies(MAX_UNINTERRUPTIBLE_TIMEOUT_MS)) + rc = (wait_for_completion_timeout(&ctx.done, expire) > 0); + else + rc = (wait_for_completion_interruptible_timeout( + &ctx.done, expire) > 0); + if (!rc) { usb_kill_urb(urb); retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-09 1:26 ` Alan Stern @ 2026-02-09 1:46 ` syzbot 2026-02-09 16:34 ` Alan Stern 2026-02-09 10:03 ` Oliver Neukum 1 sibling, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-09 1:46 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=161c17fa580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=120a765a580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-09 1:46 ` syzbot @ 2026-02-09 16:34 ` Alan Stern 2026-02-09 17:30 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-09 16:34 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On Sun, Feb 08, 2026 at 05:46:03PM -0800, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com > Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Here's another, more local, solution. It should fix this bug but not the underlying problem. Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -34,6 +34,8 @@ #define USBTMC_MIN_TIMEOUT 100 /* Default USB timeout (in milliseconds) */ #define USBTMC_TIMEOUT 5000 +/* Maximum USB timeout (in milliseconds) */ +#define USBTMC_MAX_TIMEOUT 60000 /* Max number of urbs used in write transfers */ #define MAX_URBS_IN_FLIGHT 16 @@ -2014,10 +2016,11 @@ static int usbtmc_ioctl_set_timeout(stru if (get_user(timeout, (__u32 __user *)arg)) return -EFAULT; - /* Note that timeout = 0 means - * MAX_SCHEDULE_TIMEOUT in usb_control_msg + /* + * Impose a maximum limit to timeouts because the waits in + * usb_control_msg and usb_bulk_msg are uninterruptible. */ - if (timeout < USBTMC_MIN_TIMEOUT) + if (timeout < USBTMC_MIN_TIMEOUT || timeout > USBTMC_MAX_TIMEOUT) return -EINVAL; file_data->timeout = timeout; ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-09 16:34 ` Alan Stern @ 2026-02-09 17:30 ` syzbot 2026-02-13 21:30 ` Alan Stern 0 siblings, 1 reply; 21+ messages in thread From: syzbot @ 2026-02-09 17:30 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=14e5465a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=15261b22580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-09 17:30 ` syzbot @ 2026-02-13 21:30 ` Alan Stern 2026-02-13 21:49 ` syzbot 0 siblings, 1 reply; 21+ messages in thread From: Alan Stern @ 2026-02-13 21:30 UTC (permalink / raw) To: syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs Let's try the approach that Oliver suggested. Alan Stern #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b Index: usb-devel/drivers/usb/core/message.c =================================================================== --- usb-devel.orig/drivers/usb/core/message.c +++ usb-devel/drivers/usb/core/message.c @@ -42,16 +42,17 @@ static void usb_api_blocking_completion( /* - * Starts urb and waits for completion or timeout. Note that this call - * is NOT interruptible. Many device driver i/o requests should be - * interruptible and therefore these drivers should implement their - * own interruptible routines. + * Starts urb and waits for completion or timeout. + * Whether or not the wait is killable depends on the flag passed in. + * For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). */ -static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length) +static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length, + bool killable) { struct api_context ctx; unsigned long expire; int retval; + long rc; init_completion(&ctx.done); urb->context = &ctx; @@ -61,12 +62,21 @@ static int usb_start_wait_urb(struct urb goto out; expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; - if (!wait_for_completion_timeout(&ctx.done, expire)) { + if (killable) + rc = wait_for_completion_killable_timeout(&ctx.done, expire); + else + rc = wait_for_completion_timeout(&ctx.done, expire); + if (rc <= 0) { usb_kill_urb(urb); - retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); + if (ctx.status != -ENOENT) + retval = ctx.status; + else if (rc == 0) + retval = -ETIMEDOUT; + else + retval = rc; dev_dbg(&urb->dev->dev, - "%s timed out on ep%d%s len=%u/%u\n", + "%s timed out or killed on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc), usb_urb_dir_in(urb) ? "in" : "out", @@ -100,7 +110,7 @@ static int usb_internal_control_msg(stru usb_fill_control_urb(urb, usb_dev, pipe, (unsigned char *)cmd, data, len, usb_api_blocking_completion, NULL); - retv = usb_start_wait_urb(urb, timeout, &length); + retv = usb_start_wait_urb(urb, timeout, &length, false); if (retv < 0) return retv; else @@ -385,10 +395,59 @@ int usb_bulk_msg(struct usb_device *usb_ usb_fill_bulk_urb(urb, usb_dev, pipe, data, len, usb_api_blocking_completion, NULL); - return usb_start_wait_urb(urb, timeout, actual_length); + return usb_start_wait_urb(urb, timeout, actual_length, false); } EXPORT_SYMBOL_GPL(usb_bulk_msg); +/** + * usb_bulk_msg_killable - Builds a bulk urb, sends it off and waits for completion in a killable state + * @usb_dev: pointer to the usb device to send the message to + * @pipe: endpoint "pipe" to send the message to + * @data: pointer to the data to send + * @len: length in bytes of the data to send + * @actual_length: pointer to a location to put the actual length transferred + * in bytes + * @timeout: time in msecs to wait for the message to complete before + * timing out (if 0 the wait is forever) + * + * Context: task context, might sleep. + * + * This function is just like usb_blk_msg() except that it waits in a + * killable state. + * + * Return: + * If successful, 0. Otherwise a negative error number. The number of actual + * bytes transferred will be stored in the @actual_length parameter. + * + */ +int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe, + void *data, int len, int *actual_length, int timeout) +{ + struct urb *urb; + struct usb_host_endpoint *ep; + + ep = usb_pipe_endpoint(usb_dev, pipe); + if (!ep || len < 0) + return -EINVAL; + + urb = usb_alloc_urb(0, GFP_KERNEL); + if (!urb) + return -ENOMEM; + + if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) == + USB_ENDPOINT_XFER_INT) { + pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30); + usb_fill_int_urb(urb, usb_dev, pipe, data, len, + usb_api_blocking_completion, NULL, + ep->desc.bInterval); + } else + usb_fill_bulk_urb(urb, usb_dev, pipe, data, len, + usb_api_blocking_completion, NULL); + + return usb_start_wait_urb(urb, timeout, actual_length, true); +} +EXPORT_SYMBOL_GPL(usb_bulk_msg_killable); + /*-------------------------------------------------------------------*/ static void sg_clean(struct usb_sg_request *io) Index: usb-devel/include/linux/usb.h =================================================================== --- usb-devel.orig/include/linux/usb.h +++ usb-devel/include/linux/usb.h @@ -1869,8 +1869,9 @@ extern int usb_control_msg(struct usb_de extern int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe, void *data, int len, int *actual_length, int timeout); extern int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe, - void *data, int len, int *actual_length, - int timeout); + void *data, int len, int *actual_length, int timeout); +extern int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe, + void *data, int len, int *actual_length, int timeout); /* wrappers around usb_control_msg() for the most common standard requests */ int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request, Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struc buffer[1] = data->bTag; buffer[2] = ~data->bTag; - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), buffer, USBTMC_HEADER_SIZE, @@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(s buffer[11] = 0; /* Reserved */ /* Send bulk URB */ - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), buffer, USBTMC_HEADER_SIZE, @@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file * actual = 0; /* Send bulk URB */ - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_rcvbulkpipe(data->usb_dev, data->bulk_in), buffer, bufsize, &actual, ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-13 21:30 ` Alan Stern @ 2026-02-13 21:49 ` syzbot 0 siblings, 0 replies; 21+ messages in thread From: syzbot @ 2026-02-13 21:49 UTC (permalink / raw) To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, stern, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Tested on: commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git console output: https://syzkaller.appspot.com/x/log.txt?x=1129fa52580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0 dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=11c46b3a580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) 2026-02-09 1:26 ` Alan Stern 2026-02-09 1:46 ` syzbot @ 2026-02-09 10:03 ` Oliver Neukum 1 sibling, 0 replies; 21+ messages in thread From: Oliver Neukum @ 2026-02-09 10:03 UTC (permalink / raw) To: Alan Stern, syzbot Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum, syzkaller-bugs On 09.02.26 02:26, Alan Stern wrote: > + expire = (timeout > 0) ? msecs_to_jiffies(timeout) : > + MAX_SCHEDULE_TIMEOUT; > + if (expire <= msecs_to_jiffies(MAX_UNINTERRUPTIBLE_TIMEOUT_MS)) > + rc = (wait_for_completion_timeout(&ctx.done, expire) > 0); > + else > + rc = (wait_for_completion_interruptible_timeout( > + &ctx.done, expire) > 0); > + if (!rc) { > usb_kill_urb(urb); > retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); Hi, is this a proof of concept or a test of the real fix? I am afraid this is highly problematic. 1. You'll hit every user of the API. These are probably not ready to handle signals. This includes usb_bulk_message() and the interrupt version. 2. wait_for_completion_interruptible_timeout() reacts to _any_ signal. Do you really want to abort for SIGIO or SIGWINCH right after urb submission? 3. The error handling is broken. You cannot tell a true timeout and a signal apart. It seems to me that really want a clean API introducing usb_X_message_killable() Regards Oliver ^ permalink raw reply [flat|nested] 21+ messages in thread
end of thread, other threads:[~2026-02-13 21:49 UTC | newest] Thread overview: 21+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-02-08 6:34 [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) syzbot 2026-02-08 8:55 ` Hillf Danton 2026-02-08 14:47 ` Alan Stern 2026-02-08 15:03 ` syzbot 2026-02-08 15:17 ` Alan Stern 2026-02-08 15:17 ` syzbot 2026-02-08 15:19 ` Alan Stern 2026-02-08 15:50 ` syzbot 2026-02-08 20:10 ` Alan Stern 2026-02-08 20:10 ` syzbot 2026-02-08 20:13 ` Alan Stern 2026-02-08 20:34 ` syzbot 2026-02-08 21:32 ` Alan Stern 2026-02-08 21:53 ` syzbot 2026-02-09 1:26 ` Alan Stern 2026-02-09 1:46 ` syzbot 2026-02-09 16:34 ` Alan Stern 2026-02-09 17:30 ` syzbot 2026-02-13 21:30 ` Alan Stern 2026-02-13 21:49 ` syzbot 2026-02-09 10:03 ` Oliver Neukum
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox