diff options
| author | Ziyi Guo <n7l8m4@u.northwestern.edu> | 2026-02-09 15:19:37 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-03-19 16:15:05 +0100 |
| commit | cc7398447810c9450c90d092efe9997569f8d96f (patch) | |
| tree | 1ffbdf9844ae984138706665f5b26aa597d97d9b /drivers/usb/image | |
| parent | c586f4bc24c3601b5fb529f7f9166733bae1eb4b (diff) | |
| download | linux-cc7398447810c9450c90d092efe9997569f8d96f.tar.gz linux-cc7398447810c9450c90d092efe9997569f8d96f.tar.bz2 linux-cc7398447810c9450c90d092efe9997569f8d96f.zip | |
usb: image: mdc800: kill download URB on timeout
commit 1be3b77de4eb89af8ae2fd6610546be778e25589 upstream.
mdc800_device_read() submits download_urb and waits for completion.
If the timeout fires and the device has not responded, the function
returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still
in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if
it indicates timeout, ensuring the URB is complete before its status
is inspected or the URB is resubmitted.
Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/image')
| -rw-r--r-- | drivers/usb/image/mdc800.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/image/mdc800.c b/drivers/usb/image/mdc800.c index 9132cc3a575b..10d72562e4d2 100644 --- a/drivers/usb/image/mdc800.c +++ b/drivers/usb/image/mdc800.c @@ -730,9 +730,11 @@ static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t l mutex_unlock(&mdc800->io_lock); return len-left; } - wait_event_timeout(mdc800->download_wait, + retval = wait_event_timeout(mdc800->download_wait, mdc800->downloaded, msecs_to_jiffies(TO_DOWNLOAD_GET_READY)); + if (!retval) + usb_kill_urb(mdc800->download_urb); mdc800->downloaded = 0; if (mdc800->download_urb->status != 0) { |