From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f169.google.com (mail-qk1-f169.google.com [209.85.222.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A6E333F362 for ; Sun, 8 Feb 2026 20:10:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770581451; cv=none; b=i2BAgESgUPFFr+A7dl6+nPNTrgFz1lCNoCAPuBmcaKCd2f0h8iqUsP0GLrbzP/FYabraGdygUqMKV+5tGt3y1sX9x6GtZkF89f84p/PsqaEkuqHpAL+/LTUCE13rNkRxpTPRRVl5QSd3MJwbPM0+aZAn6MI55j0NCOWLOUgLejs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770581451; c=relaxed/simple; bh=VsHaoxl3yrXZJKDxR52Mn9nx0AbfeZl5/DB251rGqfU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=luxEUqI8oPIYGEpifXwfHR/lUMZXpE6fCdsGgpVF0xHnNgIfY83alYxTpw8pW6nzRYKz+W1KkWQnD85G6o9Z9zX1VXTyhG9G4r71A66rWV8mNN/KH9mRE80pitZePBfsmYyCKOmoG8/Q/NSwqDdOwU1/MkDoG3U6el1ULPzqVuc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rowland.harvard.edu; spf=fail smtp.mailfrom=g.harvard.edu; dkim=pass (2048-bit key) header.d=rowland.harvard.edu header.i=@rowland.harvard.edu header.b=CSm4JAYy; arc=none smtp.client-ip=209.85.222.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rowland.harvard.edu Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=g.harvard.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rowland.harvard.edu header.i=@rowland.harvard.edu header.b="CSm4JAYy" Received: by mail-qk1-f169.google.com with SMTP id af79cd13be357-8c6af798a83so406345785a.0 for ; Sun, 08 Feb 2026 12:10:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rowland.harvard.edu; s=google; t=1770581450; x=1771186250; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=hdGehabWtJkkC+Aato4fNTagQNnMDbL5gHfkLO0jPho=; b=CSm4JAYy1PyclZa+a4GWPmksORU4UvtKvXC2bFdMEVDj1MZ5qjL0HAAeBUdoCbzLBu k01pTIdRgEdaIWhOTxG5m1SIuQuw1f6DWnPpLM4qcv9aj/mg0Mv2b9nhqMporlpr28BJ VoPMDW9OHV8Dr8jC/jfrffi1LRIfNgAyvgmhE3SXIeWadyrwwfsWu9KY+/QxqrlAMK56 BZmcnobGEpZ+K/sHmfIVgtE9SfmOm7cNUAsaZVDOpfxgBL8io7RXJLHQtUk8jbMs25nV lIqtryp68VYDBBs8c46VAIQzvdtGD6Rl5TRviM/zftHzz8i3RfWso5qCFoTTFZTiNK0y D4eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770581450; x=1771186250; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hdGehabWtJkkC+Aato4fNTagQNnMDbL5gHfkLO0jPho=; b=a+iDrDwdAo+UocrdschBL2Ca3k7yLJq38epUnCz6BR4Uqo7miC4LT6X/Clpxy4BsNC yuXM8Iifkl4Wtz9z0IFifP0rSUTWozoQzAaaSEq3Kz+wHbdxVvofqHd8WaWg8gCTP8oA el7AjaV4Q6bTQUyIQfkIy0J8bGXB7IfP9x7co/P5ZzOE770bmKjIVHRyFN1GEBqodvHD cTQkmZnCmXh3FbNQBGj9BWhd/s/byh0DQ2mPA/yDVAD1+mpVUiATGoOF6qAsHG15qbT/ WTDAS+2z5QEQOvKNKpT/RLzDKh5bKEVG8FOGw3x88gsD9SeGl82j1gegBI4lbSg6M0hz 4nNw== X-Forwarded-Encrypted: i=1; AJvYcCUXXPUeuTsGmeG+tHvPJymLUvqia2apVSz8QdQLTs31cbnvH4vnKhT3YGKUiDhZo8kr+HTeR6iQyNmFi+4=@vger.kernel.org X-Gm-Message-State: AOJu0YyB2G1O+J1rRg1HMkrYGUfhnlIa2yAqR/pRDm2phVQe4jLLe3Cw rOKAYPNZJCwExgzDTS+qmlZMev98V4Iekj6JH7YlPXfuCvZYrR8Yyi8Nqnj4h0YgHw== X-Gm-Gg: AZuq6aIHt4Ksg8t8MxzYgujTwVG7bZoGe4SFoJgiv5je5+4cuabA5Enq9PeFnh26L6r 70DagF9H8yc7WhY8pW18ESj/ndv8vpNiT7Ije37X/x6sGJf0kusJsBKIImugdQ9pSEX6pVIZKBO sJGRBlH+HZxW0WAI/UejTDDKwfHCQjXSxaWrGwQtFrxOCix1Szpp+Sk2AClbCGMXW1MC5U/iWJ0 HGKpQW1hJ3P2ay63nbge4ddYwOOE02m/zvcYqJyfL4A5Ug7tB63JihkxHdOqbYDaNZMEq3VL0Dy zvs3r80lfVBz4rQ8eXN47g7xf4FE31IMCeZiFBnkuWIEZSwJKUFutBfo0EEVHQpgh7470duIzWt hh9Gu5wlrz+/lXWlbLpAA6xD4htD4kvz0L0RgbF8Mzw5TNm/yN9vqvNfwfa70bDAy//6/aL66DK 42C8GdRDwwV8qk X-Received: by 2002:a05:620a:370f:b0:8c5:3045:3e7b with SMTP id af79cd13be357-8caefeb71a6mr1152837585a.26.1770581450485; Sun, 08 Feb 2026 12:10:50 -0800 (PST) Received: from rowland.harvard.edu ([2601:19b:d03:1700::94e8]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8caf982b811sm695236085a.29.2026.02.08.12.10.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Feb 2026 12:10:49 -0800 (PST) Date: Sun, 8 Feb 2026 15:10:47 -0500 From: Alan Stern To: syzbot Cc: greearb@candelatech.com, hdanton@sina.com, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, michal.pecio@gmail.com, oneukum@suse.com, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2) Message-ID: References: <6988b0ab.050a0220.1ad825.0002.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6988b0ab.050a0220.1ad825.0002.GAE@google.com> On Sun, Feb 08, 2026 at 07:50:03AM -0800, syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > INFO: task hung in usb_bulk_msg > > INFO: task syz.3.17:4981 blocked for more than 143 seconds. > Not tainted syzkaller #0 > "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. > task:syz.3.17 state:D stack:26904 pid:4981 tgid:4980 ppid:4531 task_flags:0x400040 flags:0x00080002 > Call Trace: > > context_switch kernel/sched/core.c:5260 [inline] > __schedule+0xeb0/0x3e50 kernel/sched/core.c:6867 > __schedule_loop kernel/sched/core.c:6949 [inline] > schedule+0xdd/0x390 kernel/sched/core.c:6964 > schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99 > do_wait_for_common kernel/sched/completion.c:100 [inline] > __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 > usb_start_wait_urb+0x147/0x4c0 drivers/usb/core/message.c:64 > usb_bulk_msg+0x22b/0x580 drivers/usb/core/message.c:388 > send_request_dev_dep_msg_in drivers/usb/class/usbtmc.c:1350 [inline] > usbtmc_read.cold+0x48d/0xfe7 drivers/usb/class/usbtmc.c:1408 Unfortunately the log didn't contain any new useful information. Let's try looking farther back. Alan Stern #syz test: #https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951 Index: usb-devel/drivers/usb/class/usbtmc.c =================================================================== --- usb-devel.orig/drivers/usb/class/usbtmc.c +++ usb-devel/drivers/usb/class/usbtmc.c @@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s data->bTag++; kfree(buffer); - if (retval < 0) dev_err(&data->intf->dev, "%s returned %d\n", __func__, retval); @@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file * if (count > INT_MAX) count = INT_MAX; - dev_dbg(dev, "%s(count:%zu)\n", __func__, count); + dev_info(dev, "%s(count:%zu)\n", __func__, count); retval = send_request_dev_dep_msg_in(file_data, count); @@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file * buffer, bufsize, &actual, file_data->timeout); - dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n", + dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n", __func__, retval, actual); /* Store bTag (in case we need to abort) */ @@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file * file_data->bmTransferAttributes = buffer[8]; - dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", + dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]); if (n_characters > remaining) { Index: usb-devel/drivers/usb/gadget/udc/dummy_hcd.c =================================================================== --- usb-devel.orig/drivers/usb/gadget/udc/dummy_hcd.c +++ usb-devel/drivers/usb/gadget/udc/dummy_hcd.c @@ -762,8 +762,13 @@ static int dummy_dequeue(struct usb_ep * ep = usb_ep_to_dummy_ep(_ep); dum = ep_to_dummy(ep); - if (!dum->driver) + if (!dum->driver) { + dev_info(udc_dev(dum), "Got dequeue, no driver\n"); return -ESHUTDOWN; + } + dev_info(udc_dev(dum), + "dequeuing req %p from %s, len %d buf %p\n", + req, _ep->name, _req->length, _req->buf); spin_lock_irqsave(&dum->lock, flags); list_for_each_entry(iter, &ep->queue, queue) { @@ -777,12 +782,14 @@ static int dummy_dequeue(struct usb_ep * } if (retval == 0) { - dev_dbg(udc_dev(dum), + dev_info(udc_dev(dum), "dequeued req %p from %s, len %d buf %p\n", req, _ep->name, _req->length, _req->buf); spin_unlock(&dum->lock); usb_gadget_giveback_request(_ep, _req); spin_lock(&dum->lock); + } else { + dev_info(udc_dev(dum), "request not found\n"); } spin_unlock_irqrestore(&dum->lock, flags); return retval; Index: usb-devel/drivers/usb/core/message.c =================================================================== --- usb-devel.orig/drivers/usb/core/message.c +++ usb-devel/drivers/usb/core/message.c @@ -57,15 +57,21 @@ static int usb_start_wait_urb(struct urb urb->context = &ctx; urb->actual_length = 0; retval = usb_submit_urb(urb, GFP_NOIO); - if (unlikely(retval)) + if (unlikely(retval)) { + dev_info(&urb->dev->dev, "Submission failed on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); goto out; + } expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; if (!wait_for_completion_timeout(&ctx.done, expire)) { + dev_info(&urb->dev->dev, "Killing URB on ep%d\n", + usb_endpoint_num(&urb->ep->desc)); + usb_kill_urb(urb); retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); - dev_dbg(&urb->dev->dev, + dev_info(&urb->dev->dev, "%s timed out on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc),