kernel/linux.git/drivers/usb/core/message.c, branch v6.18.21

USB: core: Limit the length of unkillable synchronous timeouts

2026-03-19T15:08:26+00:00

commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream. The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout. Signed-off-by: Alan Stern Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman

USB: usbcore: Introduce usb_bulk_msg_killable()

2026-03-19T15:08:26+00:00

commit 416909962e7cdf29fd01ac523c953f37708df93d upstream. The synchronous message API in usbcore (usb_control_msg(), usb_bulk_msg(), and so on) uses uninterruptible waits. However, drivers may call these routines in the context of a user thread, which means it ought to be possible to at least kill them. For this reason, introduce a new usb_bulk_msg_killable() function which behaves the same as usb_bulk_msg() except for using wait_for_completion_killable_timeout() instead of wait_for_completion_timeout(). The same can be done later for usb_control_msg() later on, if it turns out to be needed. Signed-off-by: Alan Stern Suggested-by: Oliver Neukum Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Link: https://patch.msgid.link/248628b4-cc83-4e81-a620-3ce4e0376d41@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman

USB: Fix descriptor count when handling invalid MBIM extended descriptor

2025-12-18T13:02:27+00:00

[ Upstream commit 5570ad1423ee60f6e972dadb63fb2e5f90a54cbe ] In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE descriptor was using 'break' upon detecting an invalid length. This was incorrect because 'break' only exits the switch statement, causing the code to fall through to cnt++, thus incorrectly incrementing the count of parsed descriptors for a descriptor that was actually invalid and being discarded. This patch changes 'break' to 'goto next_desc;' to ensure that the logic skips the counter increment and correctly proceeds to the next descriptor in the buffer. This maintains an accurate count of only the successfully parsed descriptors. Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core") Signed-off-by: Seungjin Bae Link: https://lore.kernel.org/r/20250928185611.764589-1-eeodqql09@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

USB: document some API requirements on disconnection

2024-03-02T19:37:14+00:00

A call to usb_set_interface() crashes if the device is deallocated concurrently, such as due to physical removal or a serious IO error. It could also interfere with other drivers using the device if the current driver is unbound before the call is finished. Document the need to delay driver unbinding until this call returns, which solves both issues. Document the same regarding usb_clear_halt(), which is equally known to be routinely called by drivers. Explicitly mention finishing pending operations in the documentation of the driver disconnect callback. Signed-off-by: Michal Pecio Link: https://lore.kernel.org/r/20240218092515.7635ff8c@foxbook Signed-off-by: Greg Kroah-Hartman

usb: core: constify the struct device_type usage

2024-02-19T08:35:46+00:00

Since commit aed65af1cc2f ("drivers: make device_type const"), the driver core can properly handle constant struct device_type. Move the usb_device_type, usb_if_device_type, usb_ep_device_type and usb_port_device_type variables to be constant structures as well, placing it into read-only memory which can not be modified at runtime. Signed-off-by: Ricardo B. Marliere Link: https://lore.kernel.org/r/20240218-device_cleanup-usb-v1-4-77423c4da262@marliere.net Signed-off-by: Greg Kroah-Hartman

USB: core: Change usb_get_device_descriptor() API

2023-08-08T08:45:32+00:00

The usb_get_device_descriptor() routine reads the device descriptor from the udev device and stores it directly in udev->descriptor. This interface is error prone, because the USB subsystem expects in-memory copies of a device's descriptors to be immutable once the device has been initialized. The interface is changed so that the device descriptor is left in a kmalloc-ed buffer, not copied into the usb_device structure. A pointer to the buffer is returned to the caller, who is then responsible for kfree-ing it. The corresponding changes needed in the various callers are fairly small. Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/d0111bb6-56c1-4f90-adf2-6cfe152f6561@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman

usb: Explicitly include correct DT includes

2023-07-25T16:20:02+00:00

The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it as merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Acked-by: Herve Codina Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230718143027.1064731-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman

USB: core: Fix docs warning caused by wireless_status feature

2023-04-06T15:14:14+00:00

Fix wrongly named 'dev' parameter in doc block, should have been iface: drivers/usb/core/message.c:1939: warning: Function parameter or member 'iface' not described in 'usb_set_wireless_status' drivers/usb/core/message.c:1939: warning: Excess function parameter 'dev' description in 'usb_set_wireless_status' And fix missing struct member doc in kernel API, and reorder to match struct: include/linux/usb.h:270: warning: Function parameter or member 'wireless_status_work' not described in 'usb_interface' Reported-by: Stephen Rothwell Link: https://lore.kernel.org/linux-next/20230405114807.5a57bf46@canb.auug.org.au/T/#t Fixes: 0a4db185f078 ("USB: core: Add API to change the wireless_status") Signed-off-by: Bastien Nocera Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230405092754.36579-1-hadess@hadess.net [bentiss: fix checkpatch warning] Signed-off-by: Benjamin Tissoires

USB: core: Add API to change the wireless_status

2023-04-03T11:30:32+00:00

This adds the API that allows device specific drivers to tell user-space about whether the wireless device is connected to its receiver dongle. See "USB: core: Add wireless_status sysfs attribute" for a detailed explanation of what this attribute should be used for. Signed-off-by: Bastien Nocera Acked-by: Greg Kroah-Hartman Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230302105555.51417-5-hadess@hadess.net Signed-off-by: Benjamin Tissoires

driver core: make struct device_type.uevent() take a const *

2023-01-27T12:45:36+00:00

The uevent() callback in struct device_type should not be modifying the device that is passed into it, so mark it as a const * and propagate the function signature changes out into all relevant subsystems that use this callback. Cc: Alan Stern Cc: Andreas Noever Cc: Andy Shevchenko Cc: Bard Liao Cc: Chaitanya Kulkarni Cc: Dan Williams Cc: Dmitry Torokhov Cc: Frank Rowand Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Jilin Yuan Cc: Jiri Slaby Cc: Len Brown Cc: Mark Gross Cc: "Martin K. Petersen" Cc: "Matthew Wilcox (Oracle)" Cc: Maximilian Luz Cc: Michael Jamet Cc: Ming Lei Cc: Pierre-Louis Bossart Cc: Rob Herring Cc: Sakari Ailus Cc: Sanyog Kale Cc: Sean Young Cc: Stefan Richter Cc: Thomas Gleixner Cc: Won Chung Cc: Yehezkel Bernat Acked-by: Rafael J. Wysocki Acked-by: Mika Westerberg # for Thunderbolt Acked-by: Mauro Carvalho Chehab Acked-by: Alexandre Belloni Acked-by: Heikki Krogerus Acked-by: Wolfram Sang Acked-by: Vinod Koul Acked-by: Hans de Goede Link: https://lore.kernel.org/r/20230111113018.459199-6-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman