From: CJ <firefly0158@163.com>
To: mchehab@kernel.org
Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: INFO: task hung in dvb_usb_i2c_exit on v7.3-rc2
Date: Tue, 10 Nov 2026 14:38:04 +0800 (CST) [thread overview]
Message-ID: <182ccd7f.4ef9.1a1c42d951f.Coremail.firefly0158@163.com> (raw)
Hi,
I am reporting a hung task in dvb_usb_i2c_exit. It is still reproducible on
Linux v7.3-rc2 (HEAD df2908090cda368b01ff43709f51890076c56157) with a syzkaller reproducer.
syzbot originally reported "INFO: task hung in dvb_usb_i2c_exit" on linux-6.1
(https://syzkaller.appspot.com/bug?extid=2e0307b121d180fca081). The target console shows a matching failure signature.
The reproducer probes and then tears down a DVB USB adapter, reaching dvb_usb_i2c_exit while the i2c adapter still has outstanding work.
On the target, the kernel reports:
INFO: task kworker/1:1:44 blocked for more than 142 seconds.
The diagnostic path is i2c_del_adapter -> dvb_usb_i2c_exit -> dvb_usb_device_exit -> cxusb_probe.
It shares 19 key stack frames with the original hung task
report, including wait_for_completion, i2c_del_adapter, dvb_usb_i2c_exit, dvb_usb_device_exit.
This looks like the i2c adapter teardown waiting for a completion that the emulated device never signals.
This is a follow-up for an existing syzbot report and describes an
observed failure, not a bisected root cause.
Reproducer:
syz reproducer:
syz_open_dev$usbfs(&(0x7f00000000c0), 0x203, 0x8401)
syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0)
syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x3, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x4, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x5, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x6, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x7, 0x402)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x800)
sched_setscheduler(0x0, 0x2, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
console output: https://pastebin.com/raw/1La2BM5e
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6a5cbd268406bf43
Kernel:
HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: linux-stable
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2
Let me know if you need more details or testing.
Thanks.
reply other threads:[~2026-11-10 6:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=182ccd7f.4ef9.1a1c42d951f.Coremail.firefly0158@163.com \
--to=firefly0158@163.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®