From nobody Mon Feb 9 12:45:33 2026 Received: from mail-qt1-f181.google.com (mail-qt1-f181.google.com [209.85.160.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A0493469D for ; Mon, 9 Feb 2026 06:01:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770616877; cv=none; b=fIXqN0RLI24QUFYeT622B9hFiAaY6KzJtVtB5pm99gknz0Hni15+VILFZllEazydTBuZim9BJWdmQ4rinjjfdGraae9RJjsGBXX7lebv+n5qNwGNa0jbEs4otkliMWJ54uQlBnnqcf1HHRL/5DxQB4AmOmNzhHjyxg0ib5wOy4w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770616877; c=relaxed/simple; bh=aJVXTQ4LY0IO1aalWkLVsdJepRGTZS7ylFoEV9fnajY=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=GurA0X6+MaoQRzytCMKuVcCPfDxQnoO9yzJcVtu5NRdi7Q6IUUz/zx5yWUWjJkuGUWM/QRRPfKQvqcIkf4sAbjBAGTt+5s3oR45tF9iPipC2S9veimKnERpB2ozfzplveH2hR6GnLUJuIVO9MSBeZgV6MyI0wsNVRiIb5FaONSQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=u.northwestern.edu; spf=pass smtp.mailfrom=u.northwestern.edu; dkim=pass (2048-bit key) header.d=u-northwestern-edu.20230601.gappssmtp.com header.i=@u-northwestern-edu.20230601.gappssmtp.com header.b=AfuOD17Y; arc=none smtp.client-ip=209.85.160.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=u.northwestern.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=u.northwestern.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=u-northwestern-edu.20230601.gappssmtp.com header.i=@u-northwestern-edu.20230601.gappssmtp.com header.b="AfuOD17Y" Received: by mail-qt1-f181.google.com with SMTP id d75a77b69052e-502f101d1cfso40161401cf.1 for ; Sun, 08 Feb 2026 22:01:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=u-northwestern-edu.20230601.gappssmtp.com; s=20230601; t=1770616876; x=1771221676; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=K2L0ut82NrQYDTfHRkdswzBih5D3osXVkQWNViM8MLk=; b=AfuOD17YPrsCNu9+Fusdn/rJxLfRg9V/ODZGJAtA8q3mkgzIrGKT3B+OIsQSyJfjE8 2lyQslGRkW57HQlBReQ1JeDjMdsHkbj5YKdL/GbnztPX5z+RqfYfZ9lmP19VKU2+0jio kIMgcnH3iYdsM6WMWJwI7cGB1i+8Fe7E/rgpn14H42nWQdsXDuoRFhTIqSrJEUT0mWfI uxz3miwlHF3FyeL3e6gtUTjNHbc02q9p4QAMPNuoXEih6C3G8mjbSO5761YFP6/BeXGC PseXFIDgP3Y4CVpjLD7w7Drh08ABtu1esu4VQOU0qJJ48lMu6XzcYkqY+Gvm8XfMrrUL tYtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770616876; x=1771221676; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=K2L0ut82NrQYDTfHRkdswzBih5D3osXVkQWNViM8MLk=; b=KAPKWiJGCXIfBwPvwMhiorbB23x4uX2BaUGmb3ZlKFXsF6vouBTtjESyexTrAxJ7cg NXHWyy39wKGdMdNZMRCy9clZCTKhTnCNAumekRqZB1xtASqiQYl58K1E+0Dm7QGZgKBk 6y3t5wlC8GkuinKEmIt5cJ6PX25gOIBBqqTQAg5w+ORiJH4i93uCDmhafKDM6r0AOEOW L7AvB1J9mKZAvw2M/eNaiqfKL42pZZG4dlUIdRH3X5Zx3s5aXFRW1I/Ubxw0X4kdzfEQ eN5pU+UNolpTUYQgYyLz90Oxl+nEuwBpFHjRr84R6NG/uGiYxUeTqYRB/eliiWH8UEjl TBrA== X-Forwarded-Encrypted: i=1; AJvYcCU4WIg1nkAbadeyqtnhr3ZhHH2SHnl+QEEfTBeY5KFr2a5y+62w4NbdsdHnxkJl9X1JmuGsrN8AmoQDS7M=@vger.kernel.org X-Gm-Message-State: AOJu0YxjAferazWWjHX42LOh5rgrySKb9xdX1nK+PVUhpzxFjuMUD+Rn 7QuZUPe1RO/tS8Lv0Q/hAXo28S+m+XQ7skQDk22HdgR6t8g6Ey+4fktstA4XM6+CuwQ= X-Gm-Gg: AZuq6aKEiQQe0Lqrc2WC7m00wZaEiA4aLhJeuCgknyhVggIuMWRajo5lj7+lxDH2l8h MREUbfzmo3aVkfWrFs+UkF/Gva+v+NgzFFL08tusZiP77MWMFagYVmusuJZOwB/uSeOsPGnqf3t PqAOrsQ+uFoXZVtJe5pJ+a/xm7kIFZ62k0rM+zhaGpgXPGRJV83JLQnrbN/MP2Lkg5LOFa4IvF8 O/yqueMXrohvVAnvp1RSOdIqGJ8pIZQlm1ZfUuIn/dAFXPePic4mm3Q3onix8dw9MGxvR+LZibu rUmq8hTO9pEXPjRrGZr9hndJDz+rspu2ISVc+fzb7nQMRbg+kU/xSksuCL9C+7sLK0NfaiKKV+P 0AnHmb7w8L0EqppJqT7uTzCRlRIP1xpTf67fk0jP/bOQZAjTye30dL7j4e0QmNsp+kTEB8oS8n6 tuqlj2ERH+66enWWZOpd72pRaMzn0Li1X4SXoPLLIIADLCMMWX8FTIXOUP2HNYeGG1ACWHr4bTK rmMI5hBUGWbezCEwPo02aV+UxMZPsY= X-Received: by 2002:ac8:7f41:0:b0:4f1:cd72:f22b with SMTP id d75a77b69052e-506399ba43cmr153657071cf.52.1770616876621; Sun, 08 Feb 2026 22:01:16 -0800 (PST) Received: from security.cs.northwestern.edu (security.cs.northwestern.edu. [165.124.184.136]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89546b09f77sm55007256d6.31.2026.02.08.22.01.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Feb 2026 22:01:16 -0800 (PST) From: Ziyi Guo To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Ziyi Guo Subject: [PATCH] usb: image: mdc800: kill download URB on timeout Date: Mon, 9 Feb 2026 06:01:13 +0000 Message-Id: <20260209060113.1731338-1-n7l8m4@u.northwestern.edu> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active. A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb(): "URB submitted while active" Add usb_kill_urb() on the download timeout error path, mirroring how the write path in the same driver already handles its URB timeout (line 863). Similar to - commit 372c93131998 ("USB: yurex: fix control-URB timeout handling") - commit b98d5000c505 ("media: rc: iguanair: handle timeouts") Signed-off-by: Ziyi Guo --- drivers/usb/image/mdc800.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/image/mdc800.c b/drivers/usb/image/mdc800.c index 7b7e1554ea20..c4df637b2a03 100644 --- a/drivers/usb/image/mdc800.c +++ b/drivers/usb/image/mdc800.c @@ -736,6 +736,7 @@ static ssize_t mdc800_device_read (struct file *file, c= har __user *buf, size_t l mdc800->downloaded =3D 0; if (mdc800->download_urb->status !=3D 0) { + usb_kill_urb(mdc800->download_urb); dev_err(&mdc800->dev->dev, "request download-bytes fails " "(status=3D%i)\n", --=20 2.34.1