Re: [syzbot] [libertas?] INFO: task hung in lbs_remove_card

Hillf Danton
2026-02-28T03:36:09Z

> Date: Fri, 27 Feb 2026 03:22:26 -0800 [thread overview]
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: bb375c251ab4 dt-bindings: usb: st,st-ohci-300x: convert to..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1141755a580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f1500201919951cc
> dashboard link: https://syzkaller.appspot.com/bug?extid=c99d17aa44dbdba16ad2
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1191555a580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=114a15c6580000

#syz test

--- x/drivers/net/wireless/marvell/libertas/firmware.c
+++ y/drivers/net/wireless/marvell/libertas/firmware.c
@@ -111,9 +111,20 @@ next:
do_load_firmware(priv, iter->helper, helper_firmware_cb);
}

+static bool lbs_check_fw_loaded(struct lbs_private *priv)
+{
+ unsigned long flags;
+ bool rc;
+
+ spin_lock_irqsave(&priv->driver_lock, flags);
+ rc = priv->fw_callback == NULL;
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+ return rc;
+}
+
void lbs_wait_for_firmware_load(struct lbs_private *priv)
{
- wait_event(priv->fw_waitq, priv->fw_callback == NULL);
+ wait_event(priv->fw_waitq, true == lbs_check_fw_loaded(priv));
}

/**
--