DF-5437 — unprivileged open(/dev/ulptN) can be stalled ~4 s uninterruptibly by an evil printer

What (one line)

ulpt_open() runs ulpt_reset() whenever it observes sc_fflags == 0 (ulpt.c:413-418), and ulpt_reset() issues two sequential synchronous EP0 control requests with a 2 s timeout each (2 * USB_MS_HZ, ulpt.c:180 and ulpt.c:183). The wait inside usbd_do_request_flags() is

while (usbd_transfer_pending(xfer)) {
        lksleep(xfer, xfer->xroot->xfer_lock, 0, "WXFER", hz);   /* no PCATCH */
}

(usb_request.c:648-650) — uninterruptible: SIGKILL cannot break it; only the per-request xfer timeout ends it. A printer that NAKs the data/status stage of SOFT_RESET (trivial for an evil device — the USB spec allows indefinite NAKing) therefore pins every opening thread for ~4 s of unkillable sleep. /dev/ulptN is 0644 (ulpt.c:628), so any unprivileged local user triggers this with open("/dev/ulpt0", O_RDONLY); an open-loop pins nthreads. Bounded per open (2x2 s + the 1 s sleep granularity of the loop), repeatable per open call.

Evidence class

No usb-printer device model on the guest QEMU 7.2 (and the guest kernel's USB_REQ_DEBUG fault-injection sysctls are not built into X86_64_GENERIC) → KLD harness with the production chain shape and production constants (DF-5383 class): hx5437_stall.c implements, verbatim, the wait loop (lksleep(..., 0, "WXFER", hz)), the two-sequential-request structure of ulpt_reset (ulpt.c:179-183), and the default timeout 2000 ms = 2 * USB_MS_HZ. The "device NAKs until timeout" behavior is modelled by a callout that completes the request exactly at the timeout — which is what the xfer timeout does to a NAKed control transfer in production.

Build / Run (in guest)

sh build.sh
sh run.sh

hx5437_probe forks a child that opens the harness cdev; the parent SIGKILLs it 100 ms in; waitpid measures how long the child actually survives.

Expected decisive output

[R] SIGKILL sent at +100 ms; child reaped after 4.014 s (status=0x9)
[R] VERDICT: opener survived SIGKILL for 4.0 s -- uninterruptible stall reproduced
... (x3 baseline: 4.014 / 4.017 / 4.015 s; dmesg: ELAPSED=4000 ms x3)
=== fix mechanism (timeout_ms=250) ===
[R] SIGKILL sent at +100 ms; child reaped after 0.515 s (status=0x9)
... (dmesg: ELAPSED=500/501 ms)

The child carries the pending SIGKILL through the full 4 s of kernel sleep — it cannot be killed, scheduled away, or interrupted — then dies the moment the syscall returns. With the fix mechanism (per-request timeout bounded to USB_MS_HZ/4 = 250 ms, fix.diff) the same probe bounds the stall at ~0.5 s.

Fix

fix.diff bounds both SOFT_RESET requests to USB_MS_HZ / 4 (250 ms): SOFT_RESET carries no data, 250 ms is ample for a functional printer, and worst-case open() stall drops from ~4 s to ~0.5 s. (Framework-level hardening — PCATCH on the WXFER sleep — would additionally make the stall signal-interruptible; that is usb_request.c scope, noted for upstream.)