diff options
| author | Ziyi Guo <n7l8m4@u.northwestern.edu> | 2026-02-09 18:19:37 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-03-25 13:08:32 +0300 |
| commit | d4a400a6a4c4d49f77a04a3f401df5ae1a10657c (patch) | |
| tree | d903bfc88c8bd92b1822353812d7d84eeff7fe0d /drivers/usb/image | |
| parent | 7003be7a511891a4aa8b64b920e12a5fc7301c9d (diff) | |
| download | linux-d4a400a6a4c4d49f77a04a3f401df5ae1a10657c.tar.xz | |
usb: image: mdc800: kill download URB on timeout
commit 1be3b77de4eb89af8ae2fd6610546be778e25589 upstream.
mdc800_device_read() submits download_urb and waits for completion.
If the timeout fires and the device has not responded, the function
returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still
in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if
it indicates timeout, ensuring the URB is complete before its status
is inspected or the URB is resubmitted.
Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/image')
| -rw-r--r-- | drivers/usb/image/mdc800.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/image/mdc800.c b/drivers/usb/image/mdc800.c index 9132cc3a575b..10d72562e4d2 100644 --- a/drivers/usb/image/mdc800.c +++ b/drivers/usb/image/mdc800.c @@ -730,9 +730,11 @@ static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t l mutex_unlock(&mdc800->io_lock); return len-left; } - wait_event_timeout(mdc800->download_wait, + retval = wait_event_timeout(mdc800->download_wait, mdc800->downloaded, msecs_to_jiffies(TO_DOWNLOAD_GET_READY)); + if (!retval) + usb_kill_urb(mdc800->download_urb); mdc800->downloaded = 0; if (mdc800->download_urb->status != 0) { |