Commit 1be3b77d authored by Ziyi Guo's avatar Ziyi Guo Committed by Greg Kroah-Hartman
Browse files

usb: image: mdc800: kill download URB on timeout 



mdc800_device_read() submits download_urb and waits for completion.
If the timeout fires and the device has not responded, the function
returns without killing the URB, leaving it active.

A subsequent read() resubmits the same URB while it is still
in-flight, triggering the WARN in usb_submit_urb():

  "URB submitted while active"

Check the return value of wait_event_timeout() and kill the URB if
it indicates timeout, ensuring the URB is complete before its status
is inspected or the URB is resubmitted.

Similar to
- commit 372c9313 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000 ("media: rc: iguanair: handle timeouts")

Signed-off-by: default avatarZiyi Guo <n7l8m4@u.northwestern.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2d6d260e

drivers/usb/image/mdc800.c

+3 −1
Original line number Diff line number Diff line
@@ -730,9 +730,11 @@ static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t l 
					mutex_unlock(&mdc800->io_lock);

					return len-left;

				}

				wait_event_timeout(mdc800->download_wait,

				retval = wait_event_timeout(mdc800->download_wait,

				     mdc800->downloaded,

				     msecs_to_jiffies(TO_DOWNLOAD_GET_READY));

				if (!retval)

					usb_kill_urb(mdc800->download_urb);

				mdc800->downloaded = 0;

				if (mdc800->download_urb->status != 0)

				{