linux-kernel - Re: [syzbot] [usb?] INFO: task hung in uevent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250710125902.3195-1-hdanton@sina.com>
Date: Thu, 10 Jul 2025 20:59:01 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+592e2ab8775dbe0bf09a@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] INFO: task hung in uevent_show (2)

> Date: Sat, 09 Nov 2024 16:59:25 -0800	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    226ff2e681d0 usb: typec: ucsi: Convert connector specific ..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=132b5e30580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=358c1689354aeef3
> dashboard link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=144614e8580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=172b5e30580000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git  usb-testing

--- x/drivers/media/rc/imon.c
+++ y/drivers/media/rc/imon.c
@@ -646,15 +646,15 @@ static int send_packet(struct imon_conte
 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
 	} else {
 		/* Wait for transmission to complete (or abort) */
-		retval = wait_for_completion_interruptible(
-				&ictx->tx.finished);
-		if (retval) {
+		long rc = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 60*HZ);
+		if (rc <= 0) {
 			usb_kill_urb(ictx->tx_urb);
 			pr_err_ratelimited("task interrupted\n");
-		}
+			retval = rc ? -EINTR : -ETIMEDOUT;
+		} else
+			retval = ictx->tx.status;
 
 		ictx->tx.busy = false;
-		retval = ictx->tx.status;
 		if (retval)
 			pr_err_ratelimited("packet tx failed (%d)\n", retval);
 	}
@@ -1765,6 +1765,7 @@ static void usb_rx_callback_intf0(struct
 		break;
 
 	default:
+		return;
 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
 			 __func__, urb->status);
 		break;
@@ -1806,6 +1807,7 @@ static void usb_rx_callback_intf1(struct
 		break;
 
 	default:
+		return;
 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
 			 __func__, urb->status);
 		break;
--