linux-kernel - Re: [syzbot] [usb?] INFO: task hung in usb_bulk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com>
Date: Mon, 9 Feb 2026 11:03:09 +0100
From: Oliver Neukum <oneukum@...e.com>
To: Alan Stern <stern@...land.harvard.edu>,
 syzbot <syzbot+25ba18e2c5040447585d@...kaller.appspotmail.com>
Cc: greearb@...delatech.com, hdanton@...a.com, linux-kernel@...r.kernel.org,
 linux-usb@...r.kernel.org, michal.pecio@...il.com, oneukum@...e.com,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)

On 09.02.26 02:26, Alan Stern wrote:

> +	expire = (timeout > 0) ? msecs_to_jiffies(timeout) :
> +			MAX_SCHEDULE_TIMEOUT;
> +	if (expire <= msecs_to_jiffies(MAX_UNINTERRUPTIBLE_TIMEOUT_MS))
> +		rc = (wait_for_completion_timeout(&ctx.done, expire) > 0);
> +	else
> +		rc = (wait_for_completion_interruptible_timeout(
> +				&ctx.done, expire) > 0);
> +	if (!rc) {
>   		usb_kill_urb(urb);
>   		retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);

Hi,

is this a proof of concept or a test of the real fix?

I am afraid this is highly problematic.

1. You'll hit every user of the API. These are probably not ready to handle signals. This includes usb_bulk_message() and the interrupt version.
2. wait_for_completion_interruptible_timeout() reacts to _any_ signal. Do you really want to abort for SIGIO or SIGWINCH right after urb submission?
3. The error handling is broken. You cannot tell a true timeout and a signal apart.

It seems to me that really want a clean API introducing usb_X_message_killable()

	Regards
		Oliver