Re: [syzbot] [usb?] INFO: task hung in usb_bulk_msg (2)

[Oliver Neukum]

On 09.02.26 02:26, Alan Stern wrote:

> +	expire = (timeout > 0) ? msecs_to_jiffies(timeout) :
> +			MAX_SCHEDULE_TIMEOUT;
> +	if (expire <= msecs_to_jiffies(MAX_UNINTERRUPTIBLE_TIMEOUT_MS))
> +		rc = (wait_for_completion_timeout(&ctx.done, expire) > 0);
> +	else
> +		rc = (wait_for_completion_interruptible_timeout(
> +				&ctx.done, expire) > 0);
> +	if (!rc) {
>   		usb_kill_urb(urb);
>   		retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);

Hi,

is this a proof of concept or a test of the real fix?

I am afraid this is highly problematic.

1. You'll hit every user of the API. These are probably not ready to handle signals. This includes usb_bulk_message() and the interrupt version.
2. wait_for_completion_interruptible_timeout() reacts to _any_ signal. Do you really want to abort for SIGIO or SIGWINCH right after urb submission?
3. The error handling is broken. You cannot tell a true timeout and a signal apart.

It seems to me that really want a clean API introducing usb_X_message_killable()

	Regards
		Oliver