* [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
@ 2026-02-08 6:34 syzbot
2026-02-08 8:55 ` Hillf Danton
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 6:34 UTC (permalink / raw)
To: anna-maria, frederic, linux-kernel, linux-usb, syzkaller-bugs,
tglx
Hello,
syzbot found the following issue on:
HEAD commit: da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142fab22580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/36cc3979cfa9/disk-da87d45b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8b9c4e01e1ee/vmlinux-da87d45b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/071303491de6/bzImage-da87d45b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
INFO: task syz.3.17:3963 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:27256 pid:3963 tgid:3963 ppid:3514 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
usbtmc_read+0x5f4/0x10b0 drivers/usb/class/usbtmc.c:1409
vfs_read+0x1e4/0xb30 fs/read_write.c:570
ksys_read+0x12a/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2b159faeb9
RSP: 002b:00007ffc49719d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f2b15c75fa0 RCX: 00007f2b159faeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f2b15a68c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2b15c75fac R14: 00007f2b15c75fa0 R15: 00007f2b15c75fa0
</TASK>
Showing all locks held in the system:
6 locks held by kworker/0:0/9:
#0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:1/38:
#0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90000287ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
2 locks held by kworker/u8:10/1609:
#0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900022dfca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
2 locks held by kworker/u8:13/2771:
#0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000406fca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
3 locks held by kworker/0:2/2820:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900041afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by getty/2925:
#0: ffff88811277a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
1 lock held by syz.3.17/3963:
#0: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x154/0x10b0 drivers/usb/class/usbtmc.c:1395
2 locks held by syz.4.18/4418:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
#1: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
1 lock held by syz.5.19/4873:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/1:3/4877:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006717ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.6.20/5329:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
6 locks held by kworker/0:3/5332:
#0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006e57ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
3 locks held by kworker/1:4/5738:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90005bafca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.7.21/5786:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
2 locks held by modprobe/5990:
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5991 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline]
RIP: 0010:__lock_acquire+0x341/0x2630 kernel/locking/lockdep.c:5187
Code: 38 c7 44 0f 47 f8 80 be c6 00 00 00 02 44 0f 44 f8 41 83 c6 01 48 83 c3 28 44 3b b5 a0 0a 00 00 0f 8d b2 00 00 00 0f b7 43 20 <66> 25 ff 1f 0f b7 c0 48 0f a3 05 10 d5 42 0d 72 a9 44 8b 1d 27 81
RSP: 0000:ffffc9000411f8a0 EFLAGS: 00000006
RAX: 00000000000083c5 RBX: ffff888116cc6268 RCX: 0000000000000005
RDX: 0000000000000001 RSI: ffff888116cc6240 RDI: 0000000000000000
RBP: ffff888116cc57c0 R08: 0000000000000000 R09: 0000000000000007
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888116cc6330
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005
FS: 00007feb72295c80(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feb724d4b45 CR3: 0000000122c10000 CR4: 00000000003506f0
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:867 [inline]
page_table_check_set+0x2d3/0xa10 mm/page_table_check.c:112
__page_table_check_ptes_set+0x1db/0x230 mm/page_table_check.c:212
page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
set_ptes include/linux/pgtable.h:292 [inline]
set_pte_range+0x54f/0x630 mm/memory.c:5483
filemap_map_order0_folio mm/filemap.c:3856 [inline]
filemap_map_pages+0x91f/0x1df0 mm/filemap.c:3921
do_fault_around mm/memory.c:5713 [inline]
do_read_fault mm/memory.c:5746 [inline]
do_fault mm/memory.c:5889 [inline]
do_pte_missing mm/memory.c:4401 [inline]
handle_pte_fault mm/memory.c:6273 [inline]
__handle_mm_fault+0x1e8c/0x2d30 mm/memory.c:6411
handle_mm_fault+0x36d/0xa20 mm/memory.c:6580
do_user_addr_fault+0x5ae/0x11d0 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x66/0xc0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7feb723976c0
Code: 48 89 ef e8 b2 ec fe ff 85 c0 75 de 49 8b 47 08 80 38 2f 48 89 44 24 08 0f 85 8c 01 00 00 48 63 44 24 30 48 8d 15 80 d4 13 00 <0f> b6 1c 02 48 89 c7 48 8d 05 92 d4 13 00 48 01 c3 e8 ea e4 ff ff
RSP: 002b:00007ffc4877cef0 EFLAGS: 00010246
RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00007feb724d4b40 RSI: 0000000000000000 RDI: 00007feb725309e0
RBP: 00007feb724eec96 R08: 00007feb725309e0 R09: 0000000000000000
R10: 000000000000006c R11: 0000000000000217 R12: 00007feb724ef1e4
R13: ffffffffffffff88 R14: 0000000000000002 R15: 0000000000000000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 6:34 [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) syzbot
@ 2026-02-08 8:55 ` Hillf Danton
2026-02-08 14:47 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: Hillf Danton @ 2026-02-08 8:55 UTC (permalink / raw)
To: syzbot
Cc: Michal Pecio, Ben Greear, Oliver Neukum, Alan Stern, linux-kernel,
linux-usb, syzkaller-bugs
> Date: Sat, 07 Feb 2026 22:34:31 -0800
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
> dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142fab22580000
>
If the hung can be reproduced with PREEMPT(full) instead of (voluntary), this is
a better case for spotting the reason why the underlying hardware failed to
response within two minutes.
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/36cc3979cfa9/disk-da87d45b.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/8b9c4e01e1ee/vmlinux-da87d45b.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/071303491de6/bzImage-da87d45b.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
>
> INFO: task syz.3.17:3963 blocked for more than 143 seconds.
> Not tainted syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz.3.17 state:D stack:27256 pid:3963 tgid:3963 ppid:3514 task_flags:0x400040 flags:0x00080002
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:5260 [inline]
> __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
> __schedule_loop kernel/sched/core.c:6949 [inline]
> schedule+0xdd/0x390 kernel/sched/core.c:6964
> schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
> do_wait_for_common kernel/sched/completion.c:100 [inline]
> __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
> usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
> usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
> send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
> usbtmc_read+0x5f4/0x10b0 drivers/usb/class/usbtmc.c:1409
> vfs_read+0x1e4/0xb30 fs/read_write.c:570
> ksys_read+0x12a/0x250 fs/read_write.c:715
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f2b159faeb9
> RSP: 002b:00007ffc49719d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
> RAX: ffffffffffffffda RBX: 00007f2b15c75fa0 RCX: 00007f2b159faeb9
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
> RBP: 00007f2b15a68c1f R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f2b15c75fac R14: 00007f2b15c75fa0 R15: 00007f2b15c75fa0
> </TASK>
>
> Showing all locks held in the system:
> 6 locks held by kworker/0:0/9:
> #0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
> #3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #3: ffff88810ca9f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
> #4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #4: ffff88810ca9c160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
> #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
> 1 lock held by khungtaskd/30:
> #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
> #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
> #0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
> 6 locks held by kworker/1:1/38:
> #0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc90000287ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
> #3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #3: ffff888103eaf198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
> #4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #4: ffff888103eab160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
> #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
> 2 locks held by kworker/u8:10/1609:
> #0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc900022dfca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> 2 locks held by kworker/u8:13/2771:
> #0: ffff888100089148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc9000406fca8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> 3 locks held by kworker/0:2/2820:
> #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc900041afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
> #2: ffff88810a7ae198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
> 2 locks held by getty/2925:
> #0: ffff88811277a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
> #1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
> 1 lock held by syz.3.17/3963:
> #0: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x154/0x10b0 drivers/usb/class/usbtmc.c:1395
> 2 locks held by syz.4.18/4418:
> #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
> #1: ffff88811b42ccd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
> 1 lock held by syz.5.19/4873:
> #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
> 3 locks held by kworker/1:3/4877:
> #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc90006717ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
> #2: ffff88810a7c6198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
> 1 lock held by syz.6.20/5329:
> #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
> 6 locks held by kworker/0:3/5332:
> #0: ffff88810569bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc90006e57ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
> #3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #3: ffff888103ea8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
> #4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #4: ffff88810b6c3160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
> #5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
> 3 locks held by kworker/1:4/5738:
> #0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
> #1: ffffc90005bafca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
> #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
> #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
> #2: ffff88810ab4e198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
> 1 lock held by syz.7.21/5786:
> #0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
> 2 locks held by modprobe/5990:
>
> =============================================
>
> NMI backtrace for cpu 1
> CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
> nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
> nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
> trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
> __sys_info lib/sys_info.c:157 [inline]
> sys_info+0x141/0x190 lib/sys_info.c:165
> check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
> watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
> kthread+0x3b3/0x730 kernel/kthread.c:463
> ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> </TASK>
> Sending NMI from CPU 1 to CPUs 0:
> NMI backtrace for cpu 0
> CPU: 0 UID: 0 PID: 5991 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
> RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline]
> RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline]
> RIP: 0010:__lock_acquire+0x341/0x2630 kernel/locking/lockdep.c:5187
> Code: 38 c7 44 0f 47 f8 80 be c6 00 00 00 02 44 0f 44 f8 41 83 c6 01 48 83 c3 28 44 3b b5 a0 0a 00 00 0f 8d b2 00 00 00 0f b7 43 20 <66> 25 ff 1f 0f b7 c0 48 0f a3 05 10 d5 42 0d 72 a9 44 8b 1d 27 81
> RSP: 0000:ffffc9000411f8a0 EFLAGS: 00000006
> RAX: 00000000000083c5 RBX: ffff888116cc6268 RCX: 0000000000000005
> RDX: 0000000000000001 RSI: ffff888116cc6240 RDI: 0000000000000000
> RBP: ffff888116cc57c0 R08: 0000000000000000 R09: 0000000000000007
> R10: 0000000000000005 R11: 0000000000000000 R12: ffff888116cc6330
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000005
> FS: 00007feb72295c80(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007feb724d4b45 CR3: 0000000122c10000 CR4: 00000000003506f0
> Call Trace:
> <TASK>
> lock_acquire kernel/locking/lockdep.c:5868 [inline]
> lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
> rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
> rcu_read_lock include/linux/rcupdate.h:867 [inline]
> page_table_check_set+0x2d3/0xa10 mm/page_table_check.c:112
> __page_table_check_ptes_set+0x1db/0x230 mm/page_table_check.c:212
> page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
> set_ptes include/linux/pgtable.h:292 [inline]
> set_pte_range+0x54f/0x630 mm/memory.c:5483
> filemap_map_order0_folio mm/filemap.c:3856 [inline]
> filemap_map_pages+0x91f/0x1df0 mm/filemap.c:3921
> do_fault_around mm/memory.c:5713 [inline]
> do_read_fault mm/memory.c:5746 [inline]
> do_fault mm/memory.c:5889 [inline]
> do_pte_missing mm/memory.c:4401 [inline]
> handle_pte_fault mm/memory.c:6273 [inline]
> __handle_mm_fault+0x1e8c/0x2d30 mm/memory.c:6411
> handle_mm_fault+0x36d/0xa20 mm/memory.c:6580
> do_user_addr_fault+0x5ae/0x11d0 arch/x86/mm/fault.c:1336
> handle_page_fault arch/x86/mm/fault.c:1476 [inline]
> exc_page_fault+0x66/0xc0 arch/x86/mm/fault.c:1532
> asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
> RIP: 0033:0x7feb723976c0
> Code: 48 89 ef e8 b2 ec fe ff 85 c0 75 de 49 8b 47 08 80 38 2f 48 89 44 24 08 0f 85 8c 01 00 00 48 63 44 24 30 48 8d 15 80 d4 13 00 <0f> b6 1c 02 48 89 c7 48 8d 05 92 d4 13 00 48 01 c3 e8 ea e4 ff ff
> RSP: 002b:00007ffc4877cef0 EFLAGS: 00010246
> RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 00007feb724d4b40 RSI: 0000000000000000 RDI: 00007feb725309e0
> RBP: 00007feb724eec96 R08: 00007feb725309e0 R09: 0000000000000000
> R10: 000000000000006c R11: 0000000000000217 R12: 00007feb724ef1e4
> R13: ffffffffffffff88 R14: 0000000000000002 R15: 0000000000000000
> </TASK>
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 8:55 ` Hillf Danton
@ 2026-02-08 14:47 ` Alan Stern
2026-02-08 15:03 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-08 14:47 UTC (permalink / raw)
To: Hillf Danton
Cc: syzbot, Michal Pecio, Ben Greear, Oliver Neukum, linux-kernel,
linux-usb, syzkaller-bugs
On Sun, Feb 08, 2026 at 04:55:30PM +0800, Hillf Danton wrote:
> > Date: Sat, 07 Feb 2026 22:34:31 -0800
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m..
> > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> > console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
> > dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
> > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=142fab22580000
> >
> If the hung can be reproduced with PREEMPT(full) instead of (voluntary), this is
> a better case for spotting the reason why the underlying hardware failed to
> response within two minutes.
What hardware are you talking about? This test doesn't involve any
specific hardware.
Let's get some diagnostics.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
data->bTag++;
kfree(buffer);
- if (retval < 0)
dev_err(&data->intf->dev, "%s returned %d\n",
__func__, retval);
@@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
if (count > INT_MAX)
count = INT_MAX;
- dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+ dev_info(dev, "%s(count:%zu)\n", __func__, count);
retval = send_request_dev_dep_msg_in(file_data, count);
@@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
buffer, bufsize, &actual,
file_data->timeout);
- dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+ dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
__func__, retval, actual);
/* Store bTag (in case we need to abort) */
@@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
file_data->bmTransferAttributes = buffer[8];
- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+ dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
n_characters, buffer[8]);
if (n_characters > remaining) {
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 14:47 ` Alan Stern
@ 2026-02-08 15:03 ` syzbot
2026-02-08 15:17 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 15:03 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in usb_bulk_msg
INFO: task syz.3.17:4972 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:28120 pid:4972 tgid:4971 ppid:4522 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408
vfs_read+0x1e4/0xb30 fs/read_write.c:570
ksys_read+0x12a/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8ae743aeb9
RSP: 002b:00007f8ae729f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f8ae76b5fa0 RCX: 00007f8ae743aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f8ae74a8c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8ae76b6038 R14: 00007f8ae76b5fa0 R15: 00007ffff317e338
</TASK>
Showing all locks held in the system:
3 locks held by kworker/0:0/9:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000009fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/0:1/10:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900000afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by khungtaskd/30:
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:1/37:
#0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90000277ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88811ffd8198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88811ffd8198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888117964160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888117964160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
6 locks held by kworker/1:2/1121:
#0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90001c3fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a745198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88811e01c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88811e01c198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88810cac4160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88810cac4160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
6 locks held by kworker/0:2/2808:
#0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000415fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a75d198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888113946198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888113946198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888113be7160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888113be7160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
2 locks held by getty/2922:
#0: ffff888115caa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
1 lock held by syz.3.17/4972:
#0: ffff88810bf5e4d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1394
3 locks held by kworker/0:3/4975:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90001dffca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by syz.4.18/5429:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
#1: ffff88810bf5e4d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
3 locks held by kworker/1:3/5432:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000424fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7fd198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.5.19/5886:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
1 lock held by syz.6.20/6344:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
6 locks held by kworker/0:4/6347:
#0: ffff888100ed2148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006c5fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7ed198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888117210198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888117210198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888117211160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888117211160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by syz.7.21/6802:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
1 lock held by syz.8.22/7261:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:update_sd_lb_stats.constprop.0+0xa/0x3630 kernel/sched/fair.c:11084
Code: 04 24 e8 69 fa a0 ff 4c 8b 04 24 e9 76 f9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 00 00 00 00 fc ff df <41> 57 41 56 49 89 fe 41 55 41 54 55 53 48 81 ec a0 01 00 00 48 8d
RSP: 0018:ffffc90000007968 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90000007c30 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffc900000079b8 RDI: ffffc90000007c30
RBP: 1ffff92000000f31 R08: 0000000000000000 R09: ffffed103eac485c
R10: ffff8881f56242e7 R11: ffff888100ecd400 R12: ffff8881f56242d0
R13: ffffc90000007da8 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561ec5730d28 CR3: 00000001174aa000 CR4: 00000000003506f0
Call Trace:
<IRQ>
sched_balance_find_src_group+0x99/0xc70 kernel/sched/fair.c:11365
sched_balance_rq+0x7f0/0x33a0 kernel/sched/fair.c:11851
sched_balance_domains+0x46d/0xd40 kernel/sched/fair.c:12311
_nohz_idle_balance.isra.0+0x654/0x860 kernel/sched/fair.c:12743
handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
sysvec_call_function_single+0x8f/0xb0 arch/x86/kernel/smp.c:266
</IRQ>
<TASK>
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:704
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 3a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 b3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff89207e10 EFLAGS: 00000242
RAX: 0000000000161aa1 RBX: ffffffff8922eac0 RCX: ffffffff8753acd5
RDX: 0000000000000000 RSI: ffffffff88dec902 RDI: ffffffff878e97a0
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed103eac66c5
R10: ffff8881f563362b R11: 0000000000000000 R12: fffffbfff1245d58
R13: 0000000000000000 R14: ffffffff8accd4d0 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:767
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x35b/0x4b0 kernel/sched/idle.c:332
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430
rest_init+0x251/0x260 init/main.c:757
start_kernel+0x475/0x480 init/main.c:1206
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x122/0x130 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
</TASK>
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1099b65a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=13ac5402580000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 15:03 ` syzbot
@ 2026-02-08 15:17 ` Alan Stern
2026-02-08 15:17 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-08 15:17 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in usb_bulk_msg
Okay, most likely the reason for the hang is that the count is 0. But
that doesn't explain everything. Let's get more info.
Alan Stern
#syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
---
drivers/usb/class/usbtmc.c | 7 +++----
drivers/usb/gadget/udc/dummy_hcd.c | 11 +++++++++--
2 files changed, 12 insertions(+), 6 deletions(-)
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
data->bTag++;
kfree(buffer);
- if (retval < 0)
dev_err(&data->intf->dev, "%s returned %d\n",
__func__, retval);
@@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
if (count > INT_MAX)
count = INT_MAX;
- dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+ dev_info(dev, "%s(count:%zu)\n", __func__, count);
retval = send_request_dev_dep_msg_in(file_data, count);
@@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
buffer, bufsize, &actual,
file_data->timeout);
- dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+ dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
__func__, retval, actual);
/* Store bTag (in case we need to abort) */
@@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
file_data->bmTransferAttributes = buffer[8];
- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+ dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
n_characters, buffer[8]);
if (n_characters > remaining) {
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
ep = usb_ep_to_dummy_ep(_ep);
dum = ep_to_dummy(ep);
- if (!dum->driver)
+ if (!dum->driver) {
+ dev_info(udc_dev(dum), "Got dequeue, no driver\n");
return -ESHUTDOWN;
+ }
+ dev_info(udc_dev(dum),
+ "dequeuing req %p from %s, len %d buf %p\n",
+ req, _ep->name, _req->length, _req->buf);
spin_lock_irqsave(&dum->lock, flags);
list_for_each_entry(iter, &ep->queue, queue) {
@@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
}
if (retval == 0) {
- dev_dbg(udc_dev(dum),
+ dev_info(udc_dev(dum),
"dequeued req %p from %s, len %d buf %p\n",
req, _ep->name, _req->length, _req->buf);
spin_unlock(&dum->lock);
usb_gadget_giveback_request(_ep, _req);
spin_lock(&dum->lock);
+ } else {
+ dev_info(udc_dev(dum), "request not found\n");
}
spin_unlock_irqrestore(&dum->lock, flags);
return retval;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 15:17 ` Alan Stern
@ 2026-02-08 15:17 ` syzbot
2026-02-08 15:19 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 15:17 UTC (permalink / raw)
To: stern
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
> On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> INFO: task hung in usb_bulk_msg
>
> Okay, most likely the reason for the hang is that the count is 0. But
> that doesn't explain everything. Let's get more info.
>
> Alan Stern
>
> #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
"#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address.
>
> ---
> drivers/usb/class/usbtmc.c | 7 +++----
> drivers/usb/gadget/udc/dummy_hcd.c | 11 +++++++++--
> 2 files changed, 12 insertions(+), 6 deletions(-)
>
> Index: usb-devel/drivers/usb/class/usbtmc.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/class/usbtmc.c
> +++ usb-devel/drivers/usb/class/usbtmc.c
> @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
> data->bTag++;
>
> kfree(buffer);
> - if (retval < 0)
> dev_err(&data->intf->dev, "%s returned %d\n",
> __func__, retval);
>
> @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
> if (count > INT_MAX)
> count = INT_MAX;
>
> - dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
> + dev_info(dev, "%s(count:%zu)\n", __func__, count);
>
> retval = send_request_dev_dep_msg_in(file_data, count);
>
> @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
> buffer, bufsize, &actual,
> file_data->timeout);
>
> - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
> + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
> __func__, retval, actual);
>
> /* Store bTag (in case we need to abort) */
> @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
>
> file_data->bmTransferAttributes = buffer[8];
>
> - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
> + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
> n_characters, buffer[8]);
>
> if (n_characters > remaining) {
> Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
> ep = usb_ep_to_dummy_ep(_ep);
> dum = ep_to_dummy(ep);
>
> - if (!dum->driver)
> + if (!dum->driver) {
> + dev_info(udc_dev(dum), "Got dequeue, no driver\n");
> return -ESHUTDOWN;
> + }
> + dev_info(udc_dev(dum),
> + "dequeuing req %p from %s, len %d buf %p\n",
> + req, _ep->name, _req->length, _req->buf);
>
> spin_lock_irqsave(&dum->lock, flags);
> list_for_each_entry(iter, &ep->queue, queue) {
> @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
> }
>
> if (retval == 0) {
> - dev_dbg(udc_dev(dum),
> + dev_info(udc_dev(dum),
> "dequeued req %p from %s, len %d buf %p\n",
> req, _ep->name, _req->length, _req->buf);
> spin_unlock(&dum->lock);
> usb_gadget_giveback_request(_ep, _req);
> spin_lock(&dum->lock);
> + } else {
> + dev_info(udc_dev(dum), "request not found\n");
> }
> spin_unlock_irqrestore(&dum->lock, flags);
> return retval;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 15:17 ` syzbot
@ 2026-02-08 15:19 ` Alan Stern
2026-02-08 15:50 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-08 15:19 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On Sun, Feb 08, 2026 at 07:17:53AM -0800, syzbot wrote:
> > On Sun, Feb 08, 2026 at 07:03:03AM -0800, syzbot wrote:
> >> Hello,
> >>
> >> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> >> INFO: task hung in usb_bulk_msg
> >
> > Okay, most likely the reason for the hang is that the count is 0. But
> > that doesn't explain everything. Let's get more info.
> >
> > Alan Stern
> >
> > #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
>
> "#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address.
Fix the typo...
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
data->bTag++;
kfree(buffer);
- if (retval < 0)
dev_err(&data->intf->dev, "%s returned %d\n",
__func__, retval);
@@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
if (count > INT_MAX)
count = INT_MAX;
- dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+ dev_info(dev, "%s(count:%zu)\n", __func__, count);
retval = send_request_dev_dep_msg_in(file_data, count);
@@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
buffer, bufsize, &actual,
file_data->timeout);
- dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+ dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
__func__, retval, actual);
/* Store bTag (in case we need to abort) */
@@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
file_data->bmTransferAttributes = buffer[8];
- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+ dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
n_characters, buffer[8]);
if (n_characters > remaining) {
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
ep = usb_ep_to_dummy_ep(_ep);
dum = ep_to_dummy(ep);
- if (!dum->driver)
+ if (!dum->driver) {
+ dev_info(udc_dev(dum), "Got dequeue, no driver\n");
return -ESHUTDOWN;
+ }
+ dev_info(udc_dev(dum),
+ "dequeuing req %p from %s, len %d buf %p\n",
+ req, _ep->name, _req->length, _req->buf);
spin_lock_irqsave(&dum->lock, flags);
list_for_each_entry(iter, &ep->queue, queue) {
@@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
}
if (retval == 0) {
- dev_dbg(udc_dev(dum),
+ dev_info(udc_dev(dum),
"dequeued req %p from %s, len %d buf %p\n",
req, _ep->name, _req->length, _req->buf);
spin_unlock(&dum->lock);
usb_gadget_giveback_request(_ep, _req);
spin_lock(&dum->lock);
+ } else {
+ dev_info(udc_dev(dum), "request not found\n");
}
spin_unlock_irqrestore(&dum->lock, flags);
return retval;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 15:19 ` Alan Stern
@ 2026-02-08 15:50 ` syzbot
2026-02-08 20:10 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 15:50 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in usb_bulk_msg
INFO: task syz.3.17:4981 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408
vfs_read+0x1e4/0xb30 fs/read_write.c:570
ksys_read+0x12a/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fab75baaeb9
RSP: 002b:00007fab75a0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fab75e25fa0 RCX: 00007fab75baaeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007fab75c18c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fab75e26038 R14: 00007fab75e25fa0 R15: 00007ffcbc60e758
</TASK>
Showing all locks held in the system:
3 locks held by kworker/1:0/23:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000018fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by khungtaskd/30:
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:1/38:
#0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90000287ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88810529f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88810529f198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88810529e160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88810529e160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
6 locks held by kworker/0:2/1069:
#0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90001d6fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab98198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888117f24198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888117f24198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888117f21160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888117f21160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by klogd/2853:
#0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:639 [inline]
#0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1580 [inline]
#0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1907 [inline]
#0: ffff8881f56390d8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2c5/0x3e50 kernel/sched/core.c:6772
2 locks held by getty/2928:
#0: ffff8881163f10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
1 lock held by syz.3.17/4981:
#0: ffff888120d3a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1394
2 locks held by syz.4.18/5437:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
#1: ffff888120d3a0d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
6 locks held by kworker/1:3/5441:
#0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000197fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff8881076c0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff8881076c0198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888104af0160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888104af0160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by syz.5.19/5896:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/0:3/5899:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90003dafca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810abb0198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.6.20/6352:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
1 lock held by syz.7.21/6809:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/0:4/6813:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006557ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810af38198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/0:5/6814:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000659fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/1:4/6815:
#0: ffff888103e88548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900065afca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af50198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88810529d198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88810529d198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888105285160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888105285160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by syz.8.22/7270:
#0: ffffffff8a0d7bb0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 3a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 b3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff89207e10 EFLAGS: 00000246
RAX: 000000000015142d RBX: ffffffff8922eac0 RCX: ffffffff8753acd5
RDX: 0000000000000000 RSI: ffffffff88dec96c RDI: ffffffff878e97a0
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed103eac66c5
R10: ffff8881f563362b R11: 0000000000000000 R12: fffffbfff1245d58
R13: 0000000000000000 R14: ffffffff8accd4d0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff97c59ce80 CR3: 000000011e9b8000 CR4: 00000000003506f0
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:767
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x35b/0x4b0 kernel/sched/idle.c:332
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430
rest_init+0x251/0x260 init/main.c:757
start_kernel+0x475/0x480 init/main.c:1206
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x122/0x130 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
</TASK>
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=172f065a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=1481e7fa580000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 15:50 ` syzbot
@ 2026-02-08 20:10 ` Alan Stern
2026-02-08 20:10 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-08 20:10 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On Sun, Feb 08, 2026 at 07:50:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in usb_bulk_msg
>
> INFO: task syz.3.17:4981 blocked for more than 143 seconds.
> Not tainted syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:5260 [inline]
> __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
> __schedule_loop kernel/sched/core.c:6949 [inline]
> schedule+0xdd/0x390 kernel/sched/core.c:6964
> schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
> do_wait_for_common kernel/sched/completion.c:100 [inline]
> __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
> usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
> usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
> send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
> usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408
Unfortunately the log didn't contain any new useful information. Let's
try looking farther back.
Alan Stern
#syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
data->bTag++;
kfree(buffer);
- if (retval < 0)
dev_err(&data->intf->dev, "%s returned %d\n",
__func__, retval);
@@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
if (count > INT_MAX)
count = INT_MAX;
- dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+ dev_info(dev, "%s(count:%zu)\n", __func__, count);
retval = send_request_dev_dep_msg_in(file_data, count);
@@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
buffer, bufsize, &actual,
file_data->timeout);
- dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+ dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
__func__, retval, actual);
/* Store bTag (in case we need to abort) */
@@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
file_data->bmTransferAttributes = buffer[8];
- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+ dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
n_characters, buffer[8]);
if (n_characters > remaining) {
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
ep = usb_ep_to_dummy_ep(_ep);
dum = ep_to_dummy(ep);
- if (!dum->driver)
+ if (!dum->driver) {
+ dev_info(udc_dev(dum), "Got dequeue, no driver\n");
return -ESHUTDOWN;
+ }
+ dev_info(udc_dev(dum),
+ "dequeuing req %p from %s, len %d buf %p\n",
+ req, _ep->name, _req->length, _req->buf);
spin_lock_irqsave(&dum->lock, flags);
list_for_each_entry(iter, &ep->queue, queue) {
@@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
}
if (retval == 0) {
- dev_dbg(udc_dev(dum),
+ dev_info(udc_dev(dum),
"dequeued req %p from %s, len %d buf %p\n",
req, _ep->name, _req->length, _req->buf);
spin_unlock(&dum->lock);
usb_gadget_giveback_request(_ep, _req);
spin_lock(&dum->lock);
+ } else {
+ dev_info(udc_dev(dum), "request not found\n");
}
spin_unlock_irqrestore(&dum->lock, flags);
return retval;
Index: usb-devel/drivers/usb/core/message.c
===================================================================
--- usb-devel.orig/drivers/usb/core/message.c
+++ usb-devel/drivers/usb/core/message.c
@@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb
urb->context = &ctx;
urb->actual_length = 0;
retval = usb_submit_urb(urb, GFP_NOIO);
- if (unlikely(retval))
+ if (unlikely(retval)) {
+ dev_info(&urb->dev->dev, "Submission failed on ep%d\n",
+ usb_endpoint_num(&urb->ep->desc));
goto out;
+ }
expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
if (!wait_for_completion_timeout(&ctx.done, expire)) {
+ dev_info(&urb->dev->dev, "Killing URB on ep%d\n",
+ usb_endpoint_num(&urb->ep->desc));
+
usb_kill_urb(urb);
retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
- dev_dbg(&urb->dev->dev,
+ dev_info(&urb->dev->dev,
"%s timed out on ep%d%s len=%u/%u\n",
current->comm,
usb_endpoint_num(&urb->ep->desc),
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 20:10 ` Alan Stern
@ 2026-02-08 20:10 ` syzbot
2026-02-08 20:13 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 20:10 UTC (permalink / raw)
To: stern
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
> On Sun, Feb 08, 2026 at 07:50:03AM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> INFO: task hung in usb_bulk_msg
>>
>> INFO: task syz.3.17:4981 blocked for more than 143 seconds.
>> Not tainted syzkaller #0
>> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002
>> Call Trace:
>> <TASK>
>> context_switch kernel/sched/core.c:5260 [inline]
>> __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
>> __schedule_loop kernel/sched/core.c:6949 [inline]
>> schedule+0xdd/0x390 kernel/sched/core.c:6964
>> schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
>> do_wait_for_common kernel/sched/completion.c:100 [inline]
>> __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
>> usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64
>> usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388
>> send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
>> usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408
>
> Unfortunately the log didn't contain any new useful information. Let's
> try looking farther back.
>
> Alan Stern
>
> #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
"#https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git" does not look like a valid git repo address.
>
> Index: usb-devel/drivers/usb/class/usbtmc.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/class/usbtmc.c
> +++ usb-devel/drivers/usb/class/usbtmc.c
> @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
> data->bTag++;
>
> kfree(buffer);
> - if (retval < 0)
> dev_err(&data->intf->dev, "%s returned %d\n",
> __func__, retval);
>
> @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
> if (count > INT_MAX)
> count = INT_MAX;
>
> - dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
> + dev_info(dev, "%s(count:%zu)\n", __func__, count);
>
> retval = send_request_dev_dep_msg_in(file_data, count);
>
> @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
> buffer, bufsize, &actual,
> file_data->timeout);
>
> - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
> + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
> __func__, retval, actual);
>
> /* Store bTag (in case we need to abort) */
> @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
>
> file_data->bmTransferAttributes = buffer[8];
>
> - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
> + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
> n_characters, buffer[8]);
>
> if (n_characters > remaining) {
> Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
> ep = usb_ep_to_dummy_ep(_ep);
> dum = ep_to_dummy(ep);
>
> - if (!dum->driver)
> + if (!dum->driver) {
> + dev_info(udc_dev(dum), "Got dequeue, no driver\n");
> return -ESHUTDOWN;
> + }
> + dev_info(udc_dev(dum),
> + "dequeuing req %p from %s, len %d buf %p\n",
> + req, _ep->name, _req->length, _req->buf);
>
> spin_lock_irqsave(&dum->lock, flags);
> list_for_each_entry(iter, &ep->queue, queue) {
> @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
> }
>
> if (retval == 0) {
> - dev_dbg(udc_dev(dum),
> + dev_info(udc_dev(dum),
> "dequeued req %p from %s, len %d buf %p\n",
> req, _ep->name, _req->length, _req->buf);
> spin_unlock(&dum->lock);
> usb_gadget_giveback_request(_ep, _req);
> spin_lock(&dum->lock);
> + } else {
> + dev_info(udc_dev(dum), "request not found\n");
> }
> spin_unlock_irqrestore(&dum->lock, flags);
> return retval;
> Index: usb-devel/drivers/usb/core/message.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/core/message.c
> +++ usb-devel/drivers/usb/core/message.c
> @@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb
> urb->context = &ctx;
> urb->actual_length = 0;
> retval = usb_submit_urb(urb, GFP_NOIO);
> - if (unlikely(retval))
> + if (unlikely(retval)) {
> + dev_info(&urb->dev->dev, "Submission failed on ep%d\n",
> + usb_endpoint_num(&urb->ep->desc));
> goto out;
> + }
>
> expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
> if (!wait_for_completion_timeout(&ctx.done, expire)) {
> + dev_info(&urb->dev->dev, "Killing URB on ep%d\n",
> + usb_endpoint_num(&urb->ep->desc));
> +
> usb_kill_urb(urb);
> retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
>
> - dev_dbg(&urb->dev->dev,
> + dev_info(&urb->dev->dev,
> "%s timed out on ep%d%s len=%u/%u\n",
> current->comm,
> usb_endpoint_num(&urb->ep->desc),
>
>
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 20:10 ` syzbot
@ 2026-02-08 20:13 ` Alan Stern
2026-02-08 20:34 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-08 20:13 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
Can't believe I made the same mistake again. This time for sure!
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
data->bTag++;
kfree(buffer);
- if (retval < 0)
dev_err(&data->intf->dev, "%s returned %d\n",
__func__, retval);
@@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
if (count > INT_MAX)
count = INT_MAX;
- dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+ dev_info(dev, "%s(count:%zu)\n", __func__, count);
retval = send_request_dev_dep_msg_in(file_data, count);
@@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
buffer, bufsize, &actual,
file_data->timeout);
- dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+ dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
__func__, retval, actual);
/* Store bTag (in case we need to abort) */
@@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
file_data->bmTransferAttributes = buffer[8];
- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+ dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
n_characters, buffer[8]);
if (n_characters > remaining) {
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
ep = usb_ep_to_dummy_ep(_ep);
dum = ep_to_dummy(ep);
- if (!dum->driver)
+ if (!dum->driver) {
+ dev_info(udc_dev(dum), "Got dequeue, no driver\n");
return -ESHUTDOWN;
+ }
+ dev_info(udc_dev(dum),
+ "dequeuing req %p from %s, len %d buf %p\n",
+ req, _ep->name, _req->length, _req->buf);
spin_lock_irqsave(&dum->lock, flags);
list_for_each_entry(iter, &ep->queue, queue) {
@@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
}
if (retval == 0) {
- dev_dbg(udc_dev(dum),
+ dev_info(udc_dev(dum),
"dequeued req %p from %s, len %d buf %p\n",
req, _ep->name, _req->length, _req->buf);
spin_unlock(&dum->lock);
usb_gadget_giveback_request(_ep, _req);
spin_lock(&dum->lock);
+ } else {
+ dev_info(udc_dev(dum), "request not found\n");
}
spin_unlock_irqrestore(&dum->lock, flags);
return retval;
Index: usb-devel/drivers/usb/core/message.c
===================================================================
--- usb-devel.orig/drivers/usb/core/message.c
+++ usb-devel/drivers/usb/core/message.c
@@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb
urb->context = &ctx;
urb->actual_length = 0;
retval = usb_submit_urb(urb, GFP_NOIO);
- if (unlikely(retval))
+ if (unlikely(retval)) {
+ dev_info(&urb->dev->dev, "Submission failed on ep%d\n",
+ usb_endpoint_num(&urb->ep->desc));
goto out;
+ }
expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
if (!wait_for_completion_timeout(&ctx.done, expire)) {
+ dev_info(&urb->dev->dev, "Killing URB on ep%d\n",
+ usb_endpoint_num(&urb->ep->desc));
+
usb_kill_urb(urb);
retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
- dev_dbg(&urb->dev->dev,
+ dev_info(&urb->dev->dev,
"%s timed out on ep%d%s len=%u/%u\n",
current->comm,
usb_endpoint_num(&urb->ep->desc),
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 20:13 ` Alan Stern
@ 2026-02-08 20:34 ` syzbot
2026-02-08 21:32 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 20:34 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in usb_bulk_msg
INFO: task syz.3.17:4978 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:27432 pid:4978 tgid:4976 ppid:4527 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
usb_start_wait_urb+0x157/0x270 drivers/usb/core/message.c:67
usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:394
send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline]
usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408
vfs_read+0x1e4/0xb30 fs/read_write.c:570
ksys_read+0x12a/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7eff6393aeb9
RSP: 002b:00007eff63797028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007eff63bb5fa0 RCX: 00007eff6393aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007eff639a8c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007eff63bb6038 R14: 00007eff63bb5fa0 R15: 00007ffcb37c7118
</TASK>
Showing all locks held in the system:
6 locks held by kworker/0:0/9:
#0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000009fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888117bc9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888117bc9198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88811edf8160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88811edf8160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
6 locks held by kworker/1:0/23:
#0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000018fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88811d544198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88811d544198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff88811d545160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff88811d545160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
3 locks held by kworker/1:2/700:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90001a2fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810ab0c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by getty/2922:
#0: ffff8881012830a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
6 locks held by kworker/0:2/2989:
#0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900017dfca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88810f39e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88810f39e198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888105b6d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888105b6d160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
3 locks held by kworker/1:3/3481:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000183fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810a7f4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.3.17/4978:
#0: ffff88811db8bcd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1394
2 locks held by syz.4.18/5433:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
#1: ffff88811db8bcd8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
1 lock held by syz.5.19/5891:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
6 locks held by kworker/0:3/6183:
#0: ffff8881056f0548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90004f6fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888117bce198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888117bce198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888117bca160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888117bca160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by syz.6.20/6348:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
1 lock held by syz.7.21/6805:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/0:4/6809:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90006a77ca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810ab9c198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
1 lock held by syz.8.22/7265:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/1:5/7269:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90007cffca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810abb4198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:37 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:139 [inline]
RIP: 0010:wrmsrq arch/x86/include/asm/msr.h:199 [inline]
RIP: 0010:native_apic_msr_write arch/x86/include/asm/apic.h:212 [inline]
RIP: 0010:native_apic_msr_write+0x28/0x40 arch/x86/include/asm/apic.h:206
Code: 90 90 f3 0f 1e fa 8d 87 30 ff ff ff 83 e0 ef 74 20 89 f8 83 e0 ef 83 f8 20 74 16 c1 ef 04 31 d2 89 f0 8d 8f 00 08 00 00 0f 30 <66> 90 e9 11 a9 e8 05 e9 0c a9 e8 05 89 f6 31 d2 89 cf e9 a1 af 65
RSP: 0018:ffffc90000007ec8 EFLAGS: 00000046
RAX: 0000000002db1b93 RBX: ffff8881f5623d00 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 0000000002db1b93 RDI: 0000000000000038
RBP: 0000000002db1b93 R08: 0000000000000005 R09: 000000000000003f
R10: 0000000000000020 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000020 R15: ffff8881f56280c0
FS: 0000000000000000(0000) GS:ffff88826896a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fae4eb19e80 CR3: 000000011c80c000 CR4: 00000000003506f0
Call Trace:
<IRQ>
apic_write arch/x86/include/asm/apic.h:409 [inline]
lapic_next_event+0x10/0x20 arch/x86/kernel/apic/apic.c:418
clockevents_program_event+0x26e/0x360 kernel/time/clockevents.c:334
tick_program_event+0xa9/0x140 kernel/time/tick-oneshot.c:48
hrtimer_interrupt+0x3e9/0x8c0 kernel/time/hrtimer.c:1916
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x109/0x3c0 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x8a/0xb0 arch/x86/kernel/apic/apic.c:1056
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 4a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 c3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff89207e10 EFLAGS: 00000246
RAX: 0000000000e57769 RBX: ffffffff8922eac0 RCX: ffffffff87539cd5
RDX: 0000000000000000 RSI: ffffffff88dec98e RDI: ffffffff878e97a0
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed103eac66c5
R10: ffff8881f563362b R11: 0000000000000000 R12: fffffbfff1245d58
R13: 0000000000000000 R14: ffffffff8accd4d0 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:767
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x35b/0x4b0 kernel/sched/idle.c:332
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430
rest_init+0x251/0x260 init/main.c:757
start_kernel+0x475/0x480 init/main.c:1206
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x122/0x130 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
</TASK>
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15a95402580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=11095402580000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 20:34 ` syzbot
@ 2026-02-08 21:32 ` Alan Stern
2026-02-08 21:53 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-08 21:32 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On Sun, Feb 08, 2026 at 12:34:02PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in usb_bulk_msg
Okay, I've got an idea about what's going wrong. There's even a comment
warning about this in the source code. Let's see if the idea is right.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1347,6 +1347,8 @@ static int send_request_dev_dep_msg_in(s
buffer[11] = 0; /* Reserved */
/* Send bulk URB */
+ dev_info(&data->intf->dev, "Timeout set to %d\n",
+ file_data->timeout);
retval = usb_bulk_msg(data->usb_dev,
usb_sndbulkpipe(data->usb_dev,
data->bulk_out),
@@ -1362,7 +1364,6 @@ static int send_request_dev_dep_msg_in(s
data->bTag++;
kfree(buffer);
- if (retval < 0)
dev_err(&data->intf->dev, "%s returned %d\n",
__func__, retval);
@@ -1404,7 +1405,7 @@ static ssize_t usbtmc_read(struct file *
if (count > INT_MAX)
count = INT_MAX;
- dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+ dev_info(dev, "%s(count:%zu)\n", __func__, count);
retval = send_request_dev_dep_msg_in(file_data, count);
@@ -1425,7 +1426,7 @@ static ssize_t usbtmc_read(struct file *
buffer, bufsize, &actual,
file_data->timeout);
- dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+ dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
__func__, retval, actual);
/* Store bTag (in case we need to abort) */
@@ -1470,7 +1471,7 @@ static ssize_t usbtmc_read(struct file *
file_data->bmTransferAttributes = buffer[8];
- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+ dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
n_characters, buffer[8]);
if (n_characters > remaining) {
Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
===================================================================
--- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
+++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
@@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep *
ep = usb_ep_to_dummy_ep(_ep);
dum = ep_to_dummy(ep);
- if (!dum->driver)
+ if (!dum->driver) {
+ dev_info(udc_dev(dum), "Got dequeue, no driver\n");
return -ESHUTDOWN;
+ }
+ dev_info(udc_dev(dum),
+ "dequeuing req %p from %s, len %d buf %p\n",
+ req, _ep->name, _req->length, _req->buf);
spin_lock_irqsave(&dum->lock, flags);
list_for_each_entry(iter, &ep->queue, queue) {
@@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep *
}
if (retval == 0) {
- dev_dbg(udc_dev(dum),
+ dev_info(udc_dev(dum),
"dequeued req %p from %s, len %d buf %p\n",
req, _ep->name, _req->length, _req->buf);
spin_unlock(&dum->lock);
usb_gadget_giveback_request(_ep, _req);
spin_lock(&dum->lock);
+ } else {
+ dev_info(udc_dev(dum), "request not found\n");
}
spin_unlock_irqrestore(&dum->lock, flags);
return retval;
Index: usb-devel/drivers/usb/core/message.c
===================================================================
--- usb-devel.orig/drivers/usb/core/message.c
+++ usb-devel/drivers/usb/core/message.c
@@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb
urb->context = &ctx;
urb->actual_length = 0;
retval = usb_submit_urb(urb, GFP_NOIO);
- if (unlikely(retval))
+ if (unlikely(retval)) {
+ dev_info(&urb->dev->dev, "Submission failed on ep%d\n",
+ usb_endpoint_num(&urb->ep->desc));
goto out;
+ }
expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
if (!wait_for_completion_timeout(&ctx.done, expire)) {
+ dev_info(&urb->dev->dev, "Killing URB on ep%d\n",
+ usb_endpoint_num(&urb->ep->desc));
+
usb_kill_urb(urb);
retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
- dev_dbg(&urb->dev->dev,
+ dev_info(&urb->dev->dev,
"%s timed out on ep%d%s len=%u/%u\n",
current->comm,
usb_endpoint_num(&urb->ep->desc),
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 21:32 ` Alan Stern
@ 2026-02-08 21:53 ` syzbot
2026-02-09 1:26 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-08 21:53 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in usb_bulk_msg
INFO: task syz.3.17:4974 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17 state:D stack:27384 pid:4974 tgid:4973 ppid:4524 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xeb0/0x3e50 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
usb_start_wait_urb+0x157/0x270 drivers/usb/core/message.c:67
usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:394
send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1352 [inline]
usbtmc_read.cold+0x59f/0x1075 drivers/usb/class/usbtmc.c:1410
vfs_read+0x1e4/0xb30 fs/read_write.c:570
ksys_read+0x12a/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x570 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbce20eaeb9
RSP: 002b:00007fbce1f4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fbce2365fa0 RCX: 00007fbce20eaeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007fbce2158c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbce2366038 R14: 00007fbce2365fa0 R15: 00007ffc4a036e78
</TASK>
Showing all locks held in the system:
3 locks held by kworker/0:0/9:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000009fca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
3 locks held by kworker/0:1/10:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900000afca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
6 locks held by kworker/1:0/23:
#0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000018fca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abf9198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88811b56e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88811b56e198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888106aed160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888106aed160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by khungtaskd/30:
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff894da3a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
6 locks held by kworker/1:1/65:
#0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900005b7ca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888113911198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888113911198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888113910160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888113910160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
3 locks held by kworker/1:2/1122:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90001dcfca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810abe1198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
2 locks held by getty/2924:
#0: ffff88811286f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000452f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
6 locks held by kworker/0:2/3000:
#0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900018efca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff88811bd0a198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff88811bd0a198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888117864160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888117864160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by syz.3.17/4974:
#0: ffff88811d6230d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_read+0x14a/0x270 drivers/usb/class/usbtmc.c:1396
2 locks held by syz.4.18/5430:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
#1: ffff88811d6230d8 (&data->io_mutex){+.+.}-{4:4}, at: usbtmc_open+0x4c8/0x950 drivers/usb/class/usbtmc.c:189
1 lock held by syz.5.19/5887:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
1 lock held by syz.6.20/6345:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
6 locks held by kworker/1:4/6349:
#0: ffff888105287548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900051cfca8 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af81198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff888117993198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#3: ffff888117993198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#4: ffff888104ae9160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#4: ffff888104ae9160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1006
#5: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_register_dev+0x11d/0x570 drivers/usb/core/file.c:134
1 lock held by syz.7.21/6804:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
1 lock held by syz.8.22/7262:
#0: ffffffff8a0d7bd0 (minor_rwsem){++++}-{4:4}, at: usb_open+0x23/0x220 drivers/usb/core/file.c:38
3 locks held by kworker/1:6/7266:
#0: ffff888100071948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900077cfca8 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1161 [inline]
#2: ffff88810af99198 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x3b2/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1294
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x6c3/0xa20 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:__update_blocked_fair kernel/sched/fair.c:9868 [inline]
RIP: 0010:sched_balance_update_blocked_averages+0x456/0x1dd0 kernel/sched/fair.c:9963
Code: 00 00 49 8b 9e 98 01 00 00 48 89 84 24 90 00 00 00 0f 85 fb 07 00 00 48 8d bb 28 01 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 <0f> 85 84 0f 00 00 48 8b 44 24 70 48 03 83 28 01 00 00 48 89 c3 48
RSP: 0018:ffffc900001a8d50 EFLAGS: 00000046
RAX: 1ffffffff19a16dd RBX: ffffffff8cd0b5c0 RCX: ffffffff81897273
RDX: 1ffff1103eae7263 RSI: ffffffff878e9720 RDI: ffffffff8cd0b6e8
RBP: ffffc900001a8e20 R08: ffff8881f5739318 R09: fffffbfff1599a9a
R10: ffffffff8accd4d7 R11: ffff8881f5739208 R12: dffffc0000000000
R13: ffff8881f5739998 R14: ffff8881f5739180 R15: ffff8881f57392f8
FS: 0000000000000000(0000) GS:ffff888268a6a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd3354aae80 CR3: 000000011736a000 CR4: 00000000003506f0
Call Trace:
<IRQ>
update_nohz_stats kernel/sched/fair.c:12661 [inline]
_nohz_idle_balance.isra.0+0x667/0x860 kernel/sched/fair.c:12729
handle_softirqs+0x1dd/0x8f0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
sysvec_call_function_single+0x8f/0xb0 arch/x86/kernel/smp.c:266
</IRQ>
<TASK>
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:704
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 4a a3 01 e9 53 e3 02 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 c3 12 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc9000013fe00 EFLAGS: 00000246
RAX: 0000000000df6769 RBX: ffff888101ecba80 RCX: ffffffff87539cd5
RDX: 0000000000000000 RSI: ffffffff88dec9ce RDI: ffffffff878e97a0
RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed103eae66c5
R10: ffff8881f573362b R11: 0000000000000000 R12: ffffed10203d9750
R13: 0000000000000001 R14: ffffffff8accd4d0 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:767
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x35b/0x4b0 kernel/sched/idle.c:332
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x148
</TASK>
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11b0765a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=135aaa52580000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-08 21:53 ` syzbot
@ 2026-02-09 1:26 ` Alan Stern
2026-02-09 1:46 ` syzbot
2026-02-09 10:03 ` Oliver Neukum
0 siblings, 2 replies; 21+ messages in thread
From: Alan Stern @ 2026-02-09 1:26 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On Sun, Feb 08, 2026 at 01:53:02PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in usb_bulk_msg
All right, that clinches it. There's no problem with hardware or a
device driver; the problem is that a kernel thread is stuck in an
uninterruptible wait state for a very long time.
Hopefully this patch will prevent that from happening.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/core/message.c
===================================================================
--- usb-devel.orig/drivers/usb/core/message.c
+++ usb-devel/drivers/usb/core/message.c
@@ -25,6 +25,8 @@
#include "usb.h"
+#define MAX_UNINTERRUPTIBLE_TIMEOUT_MS 60000
+
static void cancel_async_set_config(struct usb_device *udev);
struct api_context {
@@ -42,16 +44,16 @@ static void usb_api_blocking_completion(
/*
- * Starts urb and waits for completion or timeout. Note that this call
- * is NOT interruptible. Many device driver i/o requests should be
- * interruptible and therefore these drivers should implement their
- * own interruptible routines.
+ * Starts urb and waits for completion or timeout. Timeout lengths <= 0
+ * are taken to be as long as possible.
+ * The wait is NOT interruptible if the timeout period is no longer than
+ * MAX_UNINTERRUPTIBLE_TIMEOUT_MS, otherwise it IS interruptible.
*/
static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length)
{
struct api_context ctx;
unsigned long expire;
- int retval;
+ int rc, retval;
init_completion(&ctx.done);
urb->context = &ctx;
@@ -60,8 +62,14 @@ static int usb_start_wait_urb(struct urb
if (unlikely(retval))
goto out;
- expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
- if (!wait_for_completion_timeout(&ctx.done, expire)) {
+ expire = (timeout > 0) ? msecs_to_jiffies(timeout) :
+ MAX_SCHEDULE_TIMEOUT;
+ if (expire <= msecs_to_jiffies(MAX_UNINTERRUPTIBLE_TIMEOUT_MS))
+ rc = (wait_for_completion_timeout(&ctx.done, expire) > 0);
+ else
+ rc = (wait_for_completion_interruptible_timeout(
+ &ctx.done, expire) > 0);
+ if (!rc) {
usb_kill_urb(urb);
retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-09 1:26 ` Alan Stern
@ 2026-02-09 1:46 ` syzbot
2026-02-09 16:34 ` Alan Stern
2026-02-09 10:03 ` Oliver Neukum
1 sibling, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-09 1:46 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=161c17fa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=120a765a580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-09 1:26 ` Alan Stern
2026-02-09 1:46 ` syzbot
@ 2026-02-09 10:03 ` Oliver Neukum
1 sibling, 0 replies; 21+ messages in thread
From: Oliver Neukum @ 2026-02-09 10:03 UTC (permalink / raw)
To: Alan Stern, syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On 09.02.26 02:26, Alan Stern wrote:
> + expire = (timeout > 0) ? msecs_to_jiffies(timeout) :
> + MAX_SCHEDULE_TIMEOUT;
> + if (expire <= msecs_to_jiffies(MAX_UNINTERRUPTIBLE_TIMEOUT_MS))
> + rc = (wait_for_completion_timeout(&ctx.done, expire) > 0);
> + else
> + rc = (wait_for_completion_interruptible_timeout(
> + &ctx.done, expire) > 0);
> + if (!rc) {
> usb_kill_urb(urb);
> retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
Hi,
is this a proof of concept or a test of the real fix?
I am afraid this is highly problematic.
1. You'll hit every user of the API. These are probably not ready to handle signals. This includes usb_bulk_message() and the interrupt version.
2. wait_for_completion_interruptible_timeout() reacts to _any_ signal. Do you really want to abort for SIGIO or SIGWINCH right after urb submission?
3. The error handling is broken. You cannot tell a true timeout and a signal apart.
It seems to me that really want a clean API introducing usb_X_message_killable()
Regards
Oliver
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-09 1:46 ` syzbot
@ 2026-02-09 16:34 ` Alan Stern
2026-02-09 17:30 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-09 16:34 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
On Sun, Feb 08, 2026 at 05:46:03PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
> Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Here's another, more local, solution. It should fix this bug but not
the underlying problem.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -34,6 +34,8 @@
#define USBTMC_MIN_TIMEOUT 100
/* Default USB timeout (in milliseconds) */
#define USBTMC_TIMEOUT 5000
+/* Maximum USB timeout (in milliseconds) */
+#define USBTMC_MAX_TIMEOUT 60000
/* Max number of urbs used in write transfers */
#define MAX_URBS_IN_FLIGHT 16
@@ -2014,10 +2016,11 @@ static int usbtmc_ioctl_set_timeout(stru
if (get_user(timeout, (__u32 __user *)arg))
return -EFAULT;
- /* Note that timeout = 0 means
- * MAX_SCHEDULE_TIMEOUT in usb_control_msg
+ /*
+ * Impose a maximum limit to timeouts because the waits in
+ * usb_control_msg and usb_bulk_msg are uninterruptible.
*/
- if (timeout < USBTMC_MIN_TIMEOUT)
+ if (timeout < USBTMC_MIN_TIMEOUT || timeout > USBTMC_MAX_TIMEOUT)
return -EINVAL;
file_data->timeout = timeout;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-09 16:34 ` Alan Stern
@ 2026-02-09 17:30 ` syzbot
2026-02-13 21:30 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2026-02-09 17:30 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14e5465a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=15261b22580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-09 17:30 ` syzbot
@ 2026-02-13 21:30 ` Alan Stern
2026-02-13 21:49 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2026-02-13 21:30 UTC (permalink / raw)
To: syzbot
Cc: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
syzkaller-bugs
Let's try the approach that Oliver suggested.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b
Index: usb-devel/drivers/usb/core/message.c
===================================================================
--- usb-devel.orig/drivers/usb/core/message.c
+++ usb-devel/drivers/usb/core/message.c
@@ -42,16 +42,17 @@ static void usb_api_blocking_completion(
/*
- * Starts urb and waits for completion or timeout. Note that this call
- * is NOT interruptible. Many device driver i/o requests should be
- * interruptible and therefore these drivers should implement their
- * own interruptible routines.
+ * Starts urb and waits for completion or timeout.
+ * Whether or not the wait is killable depends on the flag passed in.
+ * For example, compare usb_bulk_msg() and usb_bulk_msg_killable().
*/
-static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length)
+static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length,
+ bool killable)
{
struct api_context ctx;
unsigned long expire;
int retval;
+ long rc;
init_completion(&ctx.done);
urb->context = &ctx;
@@ -61,12 +62,21 @@ static int usb_start_wait_urb(struct urb
goto out;
expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
- if (!wait_for_completion_timeout(&ctx.done, expire)) {
+ if (killable)
+ rc = wait_for_completion_killable_timeout(&ctx.done, expire);
+ else
+ rc = wait_for_completion_timeout(&ctx.done, expire);
+ if (rc <= 0) {
usb_kill_urb(urb);
- retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
+ if (ctx.status != -ENOENT)
+ retval = ctx.status;
+ else if (rc == 0)
+ retval = -ETIMEDOUT;
+ else
+ retval = rc;
dev_dbg(&urb->dev->dev,
- "%s timed out on ep%d%s len=%u/%u\n",
+ "%s timed out or killed on ep%d%s len=%u/%u\n",
current->comm,
usb_endpoint_num(&urb->ep->desc),
usb_urb_dir_in(urb) ? "in" : "out",
@@ -100,7 +110,7 @@ static int usb_internal_control_msg(stru
usb_fill_control_urb(urb, usb_dev, pipe, (unsigned char *)cmd, data,
len, usb_api_blocking_completion, NULL);
- retv = usb_start_wait_urb(urb, timeout, &length);
+ retv = usb_start_wait_urb(urb, timeout, &length, false);
if (retv < 0)
return retv;
else
@@ -385,10 +395,59 @@ int usb_bulk_msg(struct usb_device *usb_
usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
usb_api_blocking_completion, NULL);
- return usb_start_wait_urb(urb, timeout, actual_length);
+ return usb_start_wait_urb(urb, timeout, actual_length, false);
}
EXPORT_SYMBOL_GPL(usb_bulk_msg);
+/**
+ * usb_bulk_msg_killable - Builds a bulk urb, sends it off and waits for completion in a killable state
+ * @usb_dev: pointer to the usb device to send the message to
+ * @pipe: endpoint "pipe" to send the message to
+ * @data: pointer to the data to send
+ * @len: length in bytes of the data to send
+ * @actual_length: pointer to a location to put the actual length transferred
+ * in bytes
+ * @timeout: time in msecs to wait for the message to complete before
+ * timing out (if 0 the wait is forever)
+ *
+ * Context: task context, might sleep.
+ *
+ * This function is just like usb_blk_msg() except that it waits in a
+ * killable state.
+ *
+ * Return:
+ * If successful, 0. Otherwise a negative error number. The number of actual
+ * bytes transferred will be stored in the @actual_length parameter.
+ *
+ */
+int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe,
+ void *data, int len, int *actual_length, int timeout)
+{
+ struct urb *urb;
+ struct usb_host_endpoint *ep;
+
+ ep = usb_pipe_endpoint(usb_dev, pipe);
+ if (!ep || len < 0)
+ return -EINVAL;
+
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!urb)
+ return -ENOMEM;
+
+ if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+ USB_ENDPOINT_XFER_INT) {
+ pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
+ usb_fill_int_urb(urb, usb_dev, pipe, data, len,
+ usb_api_blocking_completion, NULL,
+ ep->desc.bInterval);
+ } else
+ usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
+ usb_api_blocking_completion, NULL);
+
+ return usb_start_wait_urb(urb, timeout, actual_length, true);
+}
+EXPORT_SYMBOL_GPL(usb_bulk_msg_killable);
+
/*-------------------------------------------------------------------*/
static void sg_clean(struct usb_sg_request *io)
Index: usb-devel/include/linux/usb.h
===================================================================
--- usb-devel.orig/include/linux/usb.h
+++ usb-devel/include/linux/usb.h
@@ -1869,8 +1869,9 @@ extern int usb_control_msg(struct usb_de
extern int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
void *data, int len, int *actual_length, int timeout);
extern int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
- void *data, int len, int *actual_length,
- int timeout);
+ void *data, int len, int *actual_length, int timeout);
+extern int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe,
+ void *data, int len, int *actual_length, int timeout);
/* wrappers around usb_control_msg() for the most common standard requests */
int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request,
Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struc
buffer[1] = data->bTag;
buffer[2] = ~data->bTag;
- retval = usb_bulk_msg(data->usb_dev,
+ retval = usb_bulk_msg_killable(data->usb_dev,
usb_sndbulkpipe(data->usb_dev,
data->bulk_out),
buffer, USBTMC_HEADER_SIZE,
@@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(s
buffer[11] = 0; /* Reserved */
/* Send bulk URB */
- retval = usb_bulk_msg(data->usb_dev,
+ retval = usb_bulk_msg_killable(data->usb_dev,
usb_sndbulkpipe(data->usb_dev,
data->bulk_out),
buffer, USBTMC_HEADER_SIZE,
@@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file *
actual = 0;
/* Send bulk URB */
- retval = usb_bulk_msg(data->usb_dev,
+ retval = usb_bulk_msg_killable(data->usb_dev,
usb_rcvbulkpipe(data->usb_dev,
data->bulk_in),
buffer, bufsize, &actual,
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)
2026-02-13 21:30 ` Alan Stern
@ 2026-02-13 21:49 ` syzbot
0 siblings, 0 replies; 21+ messages in thread
From: syzbot @ 2026-02-13 21:49 UTC (permalink / raw)
To: greearb, hdanton, linux-kernel, linux-usb, michal.pecio, oneukum,
stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Tested on:
commit: da87d45b usb: typec: ucsi: Add Thunderbolt alternate m..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1129fa52580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=11c46b3a580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 21+ messages in thread
end of thread, other threads:[~2026-02-13 21:49 UTC | newest]
Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-08 6:34 [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) syzbot
2026-02-08 8:55 ` Hillf Danton
2026-02-08 14:47 ` Alan Stern
2026-02-08 15:03 ` syzbot
2026-02-08 15:17 ` Alan Stern
2026-02-08 15:17 ` syzbot
2026-02-08 15:19 ` Alan Stern
2026-02-08 15:50 ` syzbot
2026-02-08 20:10 ` Alan Stern
2026-02-08 20:10 ` syzbot
2026-02-08 20:13 ` Alan Stern
2026-02-08 20:34 ` syzbot
2026-02-08 21:32 ` Alan Stern
2026-02-08 21:53 ` syzbot
2026-02-09 1:26 ` Alan Stern
2026-02-09 1:46 ` syzbot
2026-02-09 16:34 ` Alan Stern
2026-02-09 17:30 ` syzbot
2026-02-13 21:30 ` Alan Stern
2026-02-13 21:49 ` syzbot
2026-02-09 10:03 ` Oliver Neukum
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox