quoted

From: Qiang.zhang>
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu:    1-...!: (2 ticks this GP) idle=d92/1/0x4000000000000000
        softirq=25390/25392 fqs=3
        (t=12164 jiffies g=31645 q=43226)
rcu: rcu_preempt kthread starved for 12162 jiffies! g31645 f0x0
     RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu:    Unless rcu_preempt kthread gets sufficient CPU time,
        OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task
...........
usbtmc 3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0: unknown
status
received: -71 usbtmc 3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0:
unknown status received: -71 usbtmc 3-1:0.0: unknown status received:
-71 usbtmc
3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0: unknown status
received: -71 usbtmc 3-1:0.0: unknown status received: -71 usbtmc
3-1:0.0: usb_submit_urb
failed: -19

The function usbtmc_interrupt() resubmits urbs when the error status
of an urb is - EPROTO. In systems using the dummy_hcd usb controller
this can result in endless interrupt loops when the usbtmc device is disconnected

from the host system.

quoted

Since host controller drivers already try to recover from transmission
errors, there is no need to resubmit the urb or try other solutions to repair the error

situation.

quoted

In case of errors the INT pipe just stops to wait for further packets.

Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488
READ_STATUS_BYTE operation")
Cc: stable@vger.kernel.org
Reported-by: syzbot+e2eae5639e7203360018@syzkaller.appspotmail.com
Signed-off-by: Qiang.zhang <redacted>
---
 v1->v2:
 Add fixes and stable tags, modify description information.

 drivers/usb/class/usbtmc.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c

index
74d5a9c5238a..73f419adce61 100644

--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c

@@ -2324,17 +2324,10 @@ static void usbtmc_interrupt(struct urb *urb)
 		dev_err(dev, "overflow with length %d, actual length is %d\n",
 			data->iin_wMaxPacketSize, urb->actual_length);
 		fallthrough;
-	case -ECONNRESET:
-	case -ENOENT:
-	case -ESHUTDOWN:
-	case -EILSEQ:
-	case -ETIME:
-	case -EPIPE:
+	default:
 		/* urb terminated, clean up */
 		dev_dbg(dev, "urb terminated, status: %d\n", status);
 		return;
-	default:
-		dev_err(dev, "unknown status received: %d\n", status);
 	}
 exit:
 	rv = usb_submit_urb(urb, GFP_ATOMIC);
--

2.25.1

The patch looks good to me and is tested on my machine.

Ack-by: Guido Kiener [off-list ref]

-Guido

Greg,

Can you please add the patch https://patchwork.kernel.org/project/linux-usb/list/?series=520033
Dave, Alan, and I are ok with the patch.

-Guido