[PATCH v5 0/2] usb-storage: bound the ene_ub6250 probe-time card-type query

From: Hongyu Xie

Date: Fri Nov 13 2026 - 05:24:30 EST


This is v5 of the fix for the ene_ub6250 card-type probe hang. Changes
since v4, following Alan's review:

- Split the series: the transport helper comes first, the driver change
second.
- Drop the shared 10-second budget. Each transfer now gets the full
timeout; a timeout at any stage fails the query immediately and the
query is bounded to about 50 seconds at most (five transfers),
without the remaining-time bookkeeping.
- Shorten the comment above ENE_PROBE_TIMEOUT, as the reasoning is in
ene_ub6250_init().
- Drop the unused initializer of the bulk pipe variable.

The transport helper is recorded as a stable prerequisite, so the
dependency is available when the fix is backported.

The forward declaration of ene_ub6250_init() is still needed: the
unusual-device table is generated by including unusual_ene_ub6250.h
before the function definition and takes its address, so removing the
declaration breaks the build ("'ene_ub6250_init' undeclared here").
realtek_cr.c uses the same declaration for init_realtek_cr().

Testing: with the syzbot C reproducer, the unpatched kernel blocks in
the probe for more than 143 seconds and the shutdown hangs; with the fix
the probe fails after about 10 seconds with -EIO, before the SCSI host
and the scan work exist, and the system shuts down cleanly.

Hongyu Xie (2):
usb-storage: add usb_stor_bulk_transfer_buf_timeout()
usb-storage: ene_ub6250: don't let the card-type probe hang forever

drivers/usb/storage/ene_ub6250.c | 110 +++++++++++++++--------
drivers/usb/storage/transport.c | 31 +++++--
drivers/usb/storage/transport.h | 5 ++
drivers/usb/storage/unusual_ene_ub6250.h | 2 +-
4 files changed, 102 insertions(+), 46 deletions(-)

--
2.25.1