[PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers

[PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers

[Lee Yongjun]

The Option device initialization path issues bulk transfers
without a timeout. If a device does not complete a transfer,
the USB hub worker can remain blocked while holding the device
mutex, causing usb_device_read() to hang.

Use the timeout-aware bulk transfer helper for the transfers
in option_inquiry() and option_rezero(). This bounds the wait
for each probe-time transfer to 5 seconds.

Tested with the syzkaller C reproducer under QEMU/KVM. The
patched kernel repeatedly progressed through the USB device
initialization path after approximately 5 seconds without
triggering the previously observed hung-task warning.

Fixes: 32ebbe7b6ad4 ("USB: usb-storage: add filter to "option_ms" to leave unrecognized devices alone")
Reported-by: syzbot+7317196294d50d6e55c3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7317196294d50d6e55c3
Signed-off-by: Lee Yongjun <jun85566@gmail.com>
---
Changes in v2:
- Reduce the timeout from 30 to 5 seconds.
- Move the dependency note below the --- separator.
- Remove the extra blank line before Signed-off-by.

This patch depends on Hongyu Xie's pending v3 series:
https://lore.kernel.org/r/20261001123135.38831-1-xy521521@gmail.com/

v1: https://lore.kernel.org/all/20261013132033.4352-1-jun85566@gmail.com/

 drivers/usb/storage/option_ms.c | 38 +++++++++++++++++----------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/drivers/usb/storage/option_ms.c b/drivers/usb/storage/option_ms.c
index 7c0b05a36554..d844fcaaf3fc 100644
--- a/drivers/usb/storage/option_ms.c
+++ b/drivers/usb/storage/option_ms.c
@@ -10,6 +10,7 @@
 #include <linux/usb.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/jiffies.h>
 
 #include "usb.h"
 #include "transport.h"
@@ -18,6 +19,7 @@
 
 #define ZCD_FORCE_MODEM			0x01
 #define ZCD_ALLOW_MS 			0x02
+#define OPTION_MS_PROBE_TIMEOUT		(5 * HZ)
 
 static unsigned int option_zero_cd = ZCD_FORCE_MODEM;
 module_param(option_zero_cd, uint, S_IRUGO | S_IWUSR);
@@ -44,9 +46,9 @@ static int option_rezero(struct us_data *us)
 		return USB_STOR_TRANSPORT_ERROR;
 
 	memcpy(buffer, rezero_msg, sizeof(rezero_msg));
-	result = usb_stor_bulk_transfer_buf(us,
-			us->send_bulk_pipe,
-			buffer, sizeof(rezero_msg), NULL);
+	result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
+						    buffer, sizeof(rezero_msg), NULL,
+						    OPTION_MS_PROBE_TIMEOUT);
 	if (result != USB_STOR_XFER_GOOD) {
 		result = USB_STOR_XFER_ERROR;
 		goto out;
@@ -56,14 +58,14 @@ static int option_rezero(struct us_data *us)
 	 * Some of the devices need to be asked for a response, but we don't
 	 * care what that response is.
 	 */
-	usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, RESPONSE_LEN, NULL);
+	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+					   buffer, RESPONSE_LEN, NULL,
+					   OPTION_MS_PROBE_TIMEOUT);
 
 	/* Read the CSW */
-	usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, 13, NULL);
+	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+					   buffer, 13, NULL,
+					   OPTION_MS_PROBE_TIMEOUT);
 
 	result = USB_STOR_XFER_GOOD;
 
@@ -90,17 +92,17 @@ static int option_inquiry(struct us_data *us)
 		return USB_STOR_TRANSPORT_ERROR;
 
 	memcpy(buffer, inquiry_msg, sizeof(inquiry_msg));
-	result = usb_stor_bulk_transfer_buf(us,
-			us->send_bulk_pipe,
-			buffer, sizeof(inquiry_msg), NULL);
+	result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
+						    buffer, sizeof(inquiry_msg), NULL,
+						    OPTION_MS_PROBE_TIMEOUT);
 	if (result != USB_STOR_XFER_GOOD) {
 		result = USB_STOR_XFER_ERROR;
 		goto out;
 	}
 
-	result = usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, 0x24, NULL);
+	result = usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+						    buffer, 0x24, NULL,
+						    OPTION_MS_PROBE_TIMEOUT);
 	if (result != USB_STOR_XFER_GOOD) {
 		result = USB_STOR_XFER_ERROR;
 		goto out;
@@ -112,9 +114,9 @@ static int option_inquiry(struct us_data *us)
 		result = memcmp(buffer+8, "ZCOPTION", 8);
 
 	/* Read the CSW */
-	usb_stor_bulk_transfer_buf(us,
-			us->recv_bulk_pipe,
-			buffer, 13, NULL);
+	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
+					   buffer, 13, NULL,
+					   OPTION_MS_PROBE_TIMEOUT);
 
 out:
 	kfree(buffer);
-- 
2.43.0

Re: [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers

[Oliver Neukum]

Hi,

On 21.10.26 10:16, Lee Yongjun wrote:

> @@ -112,9 +114,9 @@ static int option_inquiry(struct us_data *us)
>   		result = memcmp(buffer+8, "ZCOPTION", 8);
>   
>   	/* Read the CSW */
> -	usb_stor_bulk_transfer_buf(us,
> -			us->recv_bulk_pipe,
> -			buffer, 13, NULL);
> +	usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,

You have introduced an additional failure mode with giving a timeout.

If you run into the timeout, the device will not work. That means
you can no longer ignore error returns.

	Regards
		Oliver

Re: [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers

[kernel test robot]

Hi Lee,

kernel test robot noticed the following build errors:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v7.3 next-20261020]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Lee-Yongjun/usb-storage-option_ms-bound-probe-time-bulk-transfers/20261021-171616
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20261021081616.89976-1-jun85566%40gmail.com
patch subject: [PATCH v2] usb-storage: option_ms: bound probe-time bulk transfers
config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20261022/202610220624.5aofbefV-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261022/202610220624.5aofbefV-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610220624.5aofbefV-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/usb/storage/option_ms.c: In function 'option_rezero':
>> drivers/usb/storage/option_ms.c:49:18: error: implicit declaration of function 'usb_stor_bulk_transfer_buf_timeout'; did you mean 'usb_stor_bulk_transfer_buf'? [-Wimplicit-function-declaration]
      49 |         result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
         |                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         |                  usb_stor_bulk_transfer_buf


vim +49 drivers/usb/storage/option_ms.c

    30	
    31	static int option_rezero(struct us_data *us)
    32	{
    33		static const unsigned char rezero_msg[] = {
    34		  0x55, 0x53, 0x42, 0x43, 0x78, 0x56, 0x34, 0x12,
    35		  0x01, 0x00, 0x00, 0x00, 0x80, 0x00, 0x06, 0x01,
    36		  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    37		  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    38		};
    39		char *buffer;
    40		int result;
    41	
    42		usb_stor_dbg(us, "Option MS: %s\n", "DEVICE MODE SWITCH");
    43	
    44		buffer = kzalloc(RESPONSE_LEN, GFP_KERNEL);
    45		if (buffer == NULL)
    46			return USB_STOR_TRANSPORT_ERROR;
    47	
    48		memcpy(buffer, rezero_msg, sizeof(rezero_msg));
  > 49		result = usb_stor_bulk_transfer_buf_timeout(us, us->send_bulk_pipe,
    50							    buffer, sizeof(rezero_msg), NULL,
    51							    OPTION_MS_PROBE_TIMEOUT);
    52		if (result != USB_STOR_XFER_GOOD) {
    53			result = USB_STOR_XFER_ERROR;
    54			goto out;
    55		}
    56	
    57		/*
    58		 * Some of the devices need to be asked for a response, but we don't
    59		 * care what that response is.
    60		 */
    61		usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
    62						   buffer, RESPONSE_LEN, NULL,
    63						   OPTION_MS_PROBE_TIMEOUT);
    64	
    65		/* Read the CSW */
    66		usb_stor_bulk_transfer_buf_timeout(us, us->recv_bulk_pipe,
    67						   buffer, 13, NULL,
    68						   OPTION_MS_PROBE_TIMEOUT);
    69	
    70		result = USB_STOR_XFER_GOOD;
    71	
    72	out:
    73		kfree(buffer);
    74		return result;
    75	}
    76	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki