* INFO: task hung in dvb_usb_i2c_exit on v7.3-rc2
@ 2026-11-10 6:38 CJ
0 siblings, 0 replies; only message in thread
From: CJ @ 2026-11-10 6:38 UTC (permalink / raw)
To: mchehab; +Cc: linux-media, linux-kernel
Hi,
I am reporting a hung task in dvb_usb_i2c_exit. It is still reproducible on
Linux v7.3-rc2 (HEAD df2908090cda368b01ff43709f51890076c56157) with a syzkaller reproducer.
syzbot originally reported "INFO: task hung in dvb_usb_i2c_exit" on linux-6.1
(https://syzkaller.appspot.com/bug?extid=2e0307b121d180fca081). The target console shows a matching failure signature.
The reproducer probes and then tears down a DVB USB adapter, reaching dvb_usb_i2c_exit while the i2c adapter still has outstanding work.
On the target, the kernel reports:
INFO: task kworker/1:1:44 blocked for more than 142 seconds.
The diagnostic path is i2c_del_adapter -> dvb_usb_i2c_exit -> dvb_usb_device_exit -> cxusb_probe.
It shares 19 key stack frames with the original hung task
report, including wait_for_completion, i2c_del_adapter, dvb_usb_i2c_exit, dvb_usb_device_exit.
This looks like the i2c adapter teardown waiting for a completion that the emulated device never signals.
This is a follow-up for an existing syzbot report and describes an
observed failure, not a bisected root cause.
Reproducer:
syz reproducer:
syz_open_dev$usbfs(&(0x7f00000000c0), 0x203, 0x8401)
syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0)
syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x3, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x4, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x5, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x6, 0x402)
syz_open_dev$I2C(&(0x7f0000000000), 0x7, 0x402)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x800)
sched_setscheduler(0x0, 0x2, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
console output: https://pastebin.com/raw/1La2BM5e
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6a5cbd268406bf43
Kernel:
HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: linux-stable
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2
Let me know if you need more details or testing.
Thanks.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-11-10 6:38 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-10 6:38 INFO: task hung in dvb_usb_i2c_exit on v7.3-rc2 CJ
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®