linux-kernel - [REGRESSION][BISECTED] usb: hub: total system freeze after running adb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <qc0nhk9c6l0a08bkfeplrm3qjssgrjkvkp@sonic.net>
Date: Mon, 17 Nov 2025 12:18:54 -0800
From: Forest <forestix@...a.casa>
To: Mathias Nyman <mathias.nyman@...ux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Alan Stern <stern@...land.harvard.edu>,
        Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
        Stefan Eichenberger <stefan.eichenberger@...adex.com>,
        Pawel Laszczak <pawell@...ence.com>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, regressions@...ts.linux.dev
Subject: [REGRESSION][BISECTED] usb: hub: total system freeze after running adb

#regzbot introduced 8f5b7e2bec1c

Running adb (android debug bridge) commands causes the entire system to
freeze some time later.

The freeze usually occurs within two hours of running adb, but not always.
Stopping adb's persistent background process with `adb kill-server` seems to
avoid the freeze. (However, this is not always possible, since the system
sometimes freezes just a few seconds after adb is launched.)

It occurs even when no android devices are connected to the system.

I am unsure whether user activity affects how soon the freeze happens.

Observations when it happens:

- No messages are written to dmesg or syslog.
- Virtual console switching no longer works.
- SysRq key commands no longer work, as far as I can tell.
- Whatever was on the display remains intact.
- Any already-playing audio enters a short loop, as though the motherboard's
  sound device is playing from a ring buffer that no longer gets updated.

I have reproduced it on mainline (6.18.0-rc5) and various older kernel
versions as early as 6.12.48, built with Debian config files and
`make olddefconfig`. Tested using Debian Stable 13.2 (trixie), and its
adb 1:34.0.5-12 package.

Git bisect identifies the culprit:
commit 8f5b7e2bec1c36578fdaa74a6951833541103e27
2025-06-11 14:24:41 +0300
usb: hub: fix detection of high tier USB3 devices behind suspended hubs

Reverting that commit (along with two later commits that build upon it)
seems to fix the problem in the mainline and longterm kernels that I tried.