From: syzbot <syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com>
To: stern@rowland.harvard.edu
Cc: linux-usb@vger.kernel.org, stern@rowland.harvard.edu,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: INFO: rcu detected stall in dummy_timer (3)
Date: Thu, 23 Apr 2026 09:05:38 -0700 [thread overview]
Message-ID: <69ea4352.a00a0220.17a17.0041.GAE@google.com> (raw)
In-Reply-To: <c23ff4f3-16a1-46ff-946e-b5dbda209f57@rowland.harvard.edu>
> I'm revisiting an old syzbot bug caused by a tight resubmit loop, this
> one in mceusb. The bug was fixed by commit 476db72e5219 ("media:
> mceusb: return without resubmitting URB in case of -EPROTO error."), but
> I want to try fixing it a different way, by changing dummy-hcd.
>
> This is a preliminary test, to make sure the bug can still be triggered.
> The patch below doesn't do anything -- yet!
>
> Alan Stern
>
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 811d22141369
This bug is already marked as fixed. No point in testing.
>
> Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c
> +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -231,6 +231,7 @@ struct urbp {
> struct list_head urbp_list;
> struct sg_mapping_iter miter;
> u32 miter_started;
> + int missing_ep_delay;
> };
>
>
> @@ -1275,6 +1276,7 @@ static int dummy_urb_enqueue(
> return -ENOMEM;
> urbp->urb = urb;
> urbp->miter_started = 0;
> + urbp->missing_ep_delay = 80; /* Microframes -> 10 ms */
>
> dum_hcd = hcd_to_dummy_hcd(hcd);
> spin_lock_irqsave(&dum_hcd->dum->lock, flags);
> @@ -1863,6 +1865,8 @@ restart:
> address |= USB_DIR_IN;
> ep = find_endpoint(dum, address);
> if (!ep) {
> +// if (--urbp->missing_ep_delay > 0)
> +// continue;
> /* set_configuration() disagreement */
> dev_dbg(dummy_dev(dum_hcd),
> "no ep configured for urb %p\n",
next parent reply other threads:[~2026-04-23 16:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <c23ff4f3-16a1-46ff-946e-b5dbda209f57@rowland.harvard.edu>
2026-04-23 16:05 ` syzbot [this message]
2026-04-23 16:11 ` INFO: rcu detected stall in dummy_timer (3) Alan Stern
2020-07-14 16:27 syzbot
2020-07-14 19:47 ` Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69ea4352.a00a0220.17a17.0041.GAE@google.com \
--to=syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox