linux-kernel - Re: [syzbot] [usb?] INFO: task hung in usb_bulk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <17f32422-a93b-492b-a879-ff0a9469b668@rowland.harvard.edu>
Date: Sun, 8 Feb 2026 09:47:45 -0500
From: Alan Stern <stern@...land.harvard.edu>
To: Hillf Danton <hdanton@...a.com>
Cc: syzbot <syzbot+25ba18e2c5040447585d@...kaller.appspotmail.com>,
	Michal Pecio <michal.pecio@...il.com>,
	Ben Greear <greearb@...delatech.com>,
	Oliver Neukum <oneukum@...e.com>, linux-kernel@...r.kernel.org,
	linux-usb@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)

On Sun, Feb 08, 2026 at 04:55:30PM +0800, Hillf Danton wrote:
> > Date: Sat, 07 Feb 2026 22:34:31 -0800
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    da87d45b1951 usb: typec: ucsi: Add Thunderbolt alternate m..
> > git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> > console output: https://syzkaller.appspot.com/x/log.txt?x=15ee9402580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a04e768f944f1aa0
> > dashboard link: https://syzkaller.appspot.com/bug?extid=25ba18e2c5040447585d
> > compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=137967fa580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=142fab22580000
> > 
> If the hung can be reproduced with PREEMPT(full) instead of (voluntary), this is
> a better case for spotting the reason why the underlying hardware failed to
> response within two minutes.

What hardware are you talking about?  This test doesn't involve any 
specific hardware.

Let's get some diagnostics.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git da87d45b1951

Index: usb-devel/drivers/usb/class/usbtmc.c
===================================================================
--- usb-devel.orig/drivers/usb/class/usbtmc.c
+++ usb-devel/drivers/usb/class/usbtmc.c
@@ -1362,7 +1362,6 @@ static int send_request_dev_dep_msg_in(s
 		data->bTag++;
 
 	kfree(buffer);
-	if (retval < 0)
 		dev_err(&data->intf->dev, "%s returned %d\n",
 			__func__, retval);
 
@@ -1404,7 +1403,7 @@ static ssize_t usbtmc_read(struct file *
 	if (count > INT_MAX)
 		count = INT_MAX;
 
-	dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
+	dev_info(dev, "%s(count:%zu)\n", __func__, count);
 
 	retval = send_request_dev_dep_msg_in(file_data, count);
 
@@ -1425,7 +1424,7 @@ static ssize_t usbtmc_read(struct file *
 			      buffer, bufsize, &actual,
 			      file_data->timeout);
 
-	dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
+	dev_info(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
 		__func__, retval, actual);
 
 	/* Store bTag (in case we need to abort) */
@@ -1470,7 +1469,7 @@ static ssize_t usbtmc_read(struct file *
 
 	file_data->bmTransferAttributes = buffer[8];
 
-	dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
+	dev_info(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
 		n_characters, buffer[8]);
 
 	if (n_characters > remaining) {