linux-kernel - Re: [syzbot] [usb?] INFO: task hung in i2c_tiny_usb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86bdd498-2012-4bb1-956b-47d91c2a334e@gmail.com>
Date: Mon, 12 Jan 2026 21:31:18 +0800
From: Wei Peng <coderlogicwei@...il.com>
To: syzbot <syzbot+30b78308ba7e64647ff8@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org, linux-i2c@...r.kernel.org
Subject: Re: [syzbot] [usb?] INFO: task hung in i2c_tiny_usb_disconnect

|Sorry! Please ignore the previous patch. It was sent by mistake. The 
correct patch is attached below. |#syz test
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 57dfe5f1a7d9..79b7c97514c9 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -12,6 +12,7 @@
  #include <linux/slab.h>
  #include <linux/string_choices.h>
  #include <linux/types.h>
+#include <linux/workqueue.h>
  
  /* include interfaces to usb layer */
  #include <linux/usb.h>
@@ -172,6 +173,8 @@ struct i2c_tiny_usb {
  	struct usb_device *usb_dev; /* the usb device for this device */
  	struct usb_interface *interface; /* the interface for this device */
  	struct i2c_adapter adapter; /* i2c related things */
+	bool disconnected; /* set to true on disconnect */
+	struct work_struct release_work; /* work struct to release the adapter */
  };
  
  static int usb_read(struct i2c_adapter *adapter, int cmd,
@@ -184,6 +187,11 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
  	if (!dmadata)
  		return -ENOMEM;
  
+	if (READ_ONCE(dev->disconnected)) {
+		kfree(dmadata);
+		return -ENODEV;
+	}
+
  	/* do control transfer */
  	ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
  			       cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
@@ -204,6 +212,11 @@ static int usb_write(struct i2c_adapter *adapter, int cmd,
  	if (!dmadata)
  		return -ENOMEM;
  
+	if (READ_ONCE(dev->disconnected)) {
+		kfree(dmadata);
+		return -ENODEV;
+	}
+
  	/* do control transfer */
  	ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
  			       cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
@@ -219,6 +232,15 @@ static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
  	kfree(dev);
  }
  
+static void i2c_tiny_usb_release(struct work_struct *work)
+{
+	struct i2c_tiny_usb *dev = container_of(work, struct i2c_tiny_usb,
+					       release_work);
+
+	i2c_del_adapter(&dev->adapter);
+	i2c_tiny_usb_free(dev);
+}
+
  static int i2c_tiny_usb_probe(struct usb_interface *interface,
  			      const struct usb_device_id *id)
  {
@@ -268,6 +290,8 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,
  
  	dev->adapter.dev.parent = &dev->interface->dev;
  
+	INIT_WORK(&dev->release_work, i2c_tiny_usb_release);
+
  	/* and finally attach to i2c layer */
  	i2c_add_adapter(&dev->adapter);
  
@@ -287,9 +311,9 @@ static void i2c_tiny_usb_disconnect(struct usb_interface *interface)
  {
  	struct i2c_tiny_usb *dev = usb_get_intfdata(interface);
  
-	i2c_del_adapter(&dev->adapter);
  	usb_set_intfdata(interface, NULL);
-	i2c_tiny_usb_free(dev);
+	WRITE_ONCE(dev->disconnected, true);
+	queue_work(system_long_wq, &dev->release_work);
  
  	dev_dbg(&interface->dev, "disconnected\n");
  }