Re: [PATCH] usb-storage: option_ms: bound probe-time bulk transfers
From: Greg KH
Date: Tue Oct 13 2026 - 15:21:07 EST
On Tue, Oct 13, 2026 at 10:20:33PM +0900, Lee Yongjun wrote:
> The Option device initialization path issues bulk transfers
> without a timeout. If a device does not complete a transfer,
> the USB hub worker can remain blocked while holding the device
> mutex, causing usb_device_read() to hang.
So a broken device?
> Use the timeout-aware bulk transfer helper for the transfers
> in option_inquiry() and option_rezero(). This bounds the wait
> for each probe-time transfer to 30 seconds.
That feels very long, are you sure that works well?
> Tested with the syzbot C reproducer under QEMU/KVM. The
> patched kernel repeatedly completed USB device initialization
> attempts after approximately 30 seconds without triggering
> the previously observed hung-task warning.
>
> This patch depends on Hongyu Xie's pending v3 series:
> https://lore.kernel.org/r/20261001123135.38831-1-xy521521@xxxxxxxxx/
This should go below the --- line and is why sashiko is confused.
> Fixes: 32ebbe7b6ad4 ("USB: usb-storage: add filter to "option_ms" to leave unrecognized devices alone")
> Reported-by: syzbot+7317196294d50d6e55c3@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=7317196294d50d6e55c3
> Assisted-by: LLM
>
> Signed-off-by: Lee Yongjun <jun85566@xxxxxxxxx>
No blank line above here is needed.
thanks,
greg k-h