usb: image: mdc800: kill download URB on timeout

mdc800_device_read() submits download_urb and waits for completion.
If the timeout fires and the device has not responded, the function
returns without killing the URB, leaving it active.

A subsequent read() resubmits the same URB while it is still
in-flight, triggering the WARN in usb_submit_urb():

  "URB submitted while active"

Check the return value of wait_event_timeout() and kill the URB if
it indicates timeout, ensuring the URB is complete before its status
is inspected or the URB is resubmitted.

Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")

Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/image/mdc800.c b/drivers/usb/image/mdc800.c
index e76a502fa9dab007b72c5a703fdd379125809d29..ca287b770e8cbdec533f7e27e114d96e1cc54e35 100644 (file)
--- a/drivers/usb/image/mdc800.c
+++ b/drivers/usb/image/mdc800.c
@@ -730,9 +730,11 @@ static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t l
                                        mutex_unlock(&mdc800->io_lock);
                                        return len-left;
                                }
-                               wait_event_timeout(mdc800->download_wait,
+                               retval = wait_event_timeout(mdc800->download_wait,
                                     mdc800->downloaded,
                                     msecs_to_jiffies(TO_DOWNLOAD_GET_READY));
+                               if (!retval)
+                                       usb_kill_urb(mdc800->download_urb);
                                mdc800->downloaded = 0;
                                if (mdc800->download_urb->status != 0)
                                {