Bug 215241 - "usbreset" tool causes hung task on kernel 5.15.3+ with Hauppauge WinTV dualHD
Summary: "usbreset" tool causes hung task on kernel 5.15.3+ with Hauppauge WinTV dualHD
Status: NEW
Alias: None
Product: Drivers
Classification: Unclassified
Component: USB (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: Default virtual assignee for Drivers/USB
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-12-06 17:56 UTC by Maximilian Böhm
Modified: 2021-12-08 22:07 UTC (History)
0 users

See Also:
Kernel Version: 5.15.3
Subsystem:
Regression: No
Bisected commit-id:


Attachments
Dmesg log (8.77 KB, text/plain)
2021-12-06 17:56 UTC, Maximilian Böhm
Details

Description Maximilian Böhm 2021-12-06 17:56:12 UTC
Created attachment 299917 [details]
Dmesg log

Hello, I have a Hauppauge WinTV dualHD DVB-T2 USB card and need to use the nifty tool usbreset to reset its connection after each standby because else it won’t work. Recently, starting with Linux 5.15.3, usbreset started causing severe hangs even to the point of my system being unable to do a proper reboot or shutdown. Same with 5.16.0-rc3. I’m now back on 5.13.2 without this problem. In the attachment you can read a dmesg log. Distro is Arch Linux.
Comment 1 Alan Stern 2021-12-06 18:17:10 UTC
You can try using "git bisect" to find the commit which caused this bad behavior.
Comment 2 Maximilian Böhm 2021-12-06 19:53:29 UTC
I’m trying, but "git tag" is only showing me versions from 2.6.11 to 5.9.9.
Comment 3 Maximilian Böhm 2021-12-06 20:03:36 UTC
Ah, it’s counting "v5.1.9, v5.10", what a mess. OK, I’m on it.
Comment 4 Maximilian Böhm 2021-12-08 16:36:16 UTC
Hallo again, found the commit:

$ git bisect bad
2899243f272f8801dceb1bb692bd1a3ae3f281c2 is the first bad commit
commit 2899243f272f8801dceb1bb692bd1a3ae3f281c2
Author: Pavel Skripkin <paskripkin@gmail.com>
Date:   Thu Jul 29 22:23:33 2021 +0200

    media: em28xx: add missing em28xx_close_extension
    
    [ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ]
    
    If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
    node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
    corrupted list bugs, since driver frees this pointer on disconnect.
    
    Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
    
    Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 drivers/media/usb/em28xx/em28xx-cards.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)


What next?
Comment 5 Alan Stern 2021-12-08 22:07:49 UTC
You should write to Paul Skripkin, telling him about this problem.  And CC: all the people listed on the Signed-off-by: lines, as well as the linux-media@vger.kernel.org list.

Note You need to log in before you can comment on or make changes to this bug.