task 1: snd ctrl will add card_dev ref count and can't call close to dec it,
it is blocked waiting for task 2 to release the USB dev lock.
task 2: usb dev lock has been locked by hung task (here is usb_disconnect),
it is hung waiting for task 1 to exit and release card_dev.
Adjust the USB lock acquisition method to non-blocking in ioctl to avoid
hang when the USB connection is closed.
Reported-and-tested-by: syzbot+73582d08864d8268b6fd@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=73582d08864d8268b6fd
Signed-off-by: Edward Adam Davis <eadavis@xxxxxx>
---
drivers/usb/core/devio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 3beb6a862e80..dd037dc4cb37 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -2605,7 +2605,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
if (!(file->f_mode & FMODE_WRITE))
return -EPERM;
- usb_lock_device(dev);
+ if (!usb_trylock_device(dev))
+ return -EBUSY;
/* Reap operations are allowed even after disconnection */
switch (cmd) {
--
2.43.0
[Index of Archives]
[Pulseaudio]
[Linux Audio Users]
[ALSA Devel]
[Fedora Desktop]
[Fedora SELinux]
[Big List of Linux Books]
[Yosemite News]
[KDE Users]