drivers/usb/dwc3/core.c | 19 ++++++++++++++++++- drivers/usb/dwc3/core.h | 4 ++++ drivers/usb/dwc3/gadget.c | 8 +++----- 3 files changed, 25 insertions(+), 6 deletions(-)
Currently dwc3_gadget_vbus_draw() can be called from atomic
context, which in turn invokes power-supply-core APIs. And
some these PMIC APIs have operations that may sleep, leading
to kernel panic.
Fix this by moving the vbus_draw into a workqueue context.
Fixes: 66e0ea341a2a ("usb: dwc3: core: Defer the probe until USB power supply ready")
Cc: stable@vger.kernel.org
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
---
drivers/usb/dwc3/core.c | 19 ++++++++++++++++++-
drivers/usb/dwc3/core.h | 4 ++++
drivers/usb/dwc3/gadget.c | 8 +++-----
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index f32b67bf73a4..c9af126b9695 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -2155,6 +2155,20 @@ static int dwc3_get_num_ports(struct dwc3 *dwc)
return 0;
}
+static void dwc3_vbus_draw_work(struct work_struct *work)
+{
+ struct dwc3 *dwc = container_of(work, struct dwc3, vbus_draw_work);
+ union power_supply_propval val = {0};
+ int ret;
+
+ val.intval = 1000 * (dwc->vbus_draw_current);
+ ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
+
+ if (ret < 0)
+ dev_dbg(dwc->dev, "Error (%d) setting vbus draw (%d mA)\n",
+ ret, dwc->vbus_draw_current);
+}
+
static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
{
struct power_supply *usb_psy;
@@ -2169,6 +2183,7 @@ static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
if (!usb_psy)
return ERR_PTR(-EPROBE_DEFER);
+ INIT_WORK(&dwc->vbus_draw_work, dwc3_vbus_draw_work);
return usb_psy;
}
@@ -2395,8 +2410,10 @@ void dwc3_core_remove(struct dwc3 *dwc)
dwc3_free_event_buffers(dwc);
- if (dwc->usb_psy)
+ if (dwc->usb_psy) {
+ cancel_work_sync(&dwc->vbus_draw_work);
power_supply_put(dwc->usb_psy);
+ }
}
EXPORT_SYMBOL_GPL(dwc3_core_remove);
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 08cc6f2b5c23..052fb18c6b5c 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -1178,6 +1178,8 @@ struct dwc3_glue_ops {
* @wakeup_pending_funcs: Indicates whether any interface has requested for
* function wakeup in bitmap format where bit position
* represents interface_id.
+ * @vbus_draw_work: Workqueue used for scheduling vbus draw work
+ * @vbus_draw_current: How much current to draw from vbus, in milliAmperes.
*/
struct dwc3 {
struct work_struct drd_work;
@@ -1413,6 +1415,8 @@ struct dwc3 {
struct dentry *debug_root;
u32 gsbuscfg0_reqinfo;
u32 wakeup_pending_funcs;
+ struct work_struct vbus_draw_work;
+ unsigned int vbus_draw_current;
};
#define INCRX_BURST_MODE 0
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9355c952c140..03d8a3a151e0 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3124,8 +3124,6 @@ static void dwc3_gadget_set_ssp_rate(struct usb_gadget *g,
static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
{
struct dwc3 *dwc = gadget_to_dwc(g);
- union power_supply_propval val = {0};
- int ret;
if (dwc->usb2_phy)
return usb_phy_set_power(dwc->usb2_phy, mA);
@@ -3133,10 +3131,10 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
if (!dwc->usb_psy)
return -EOPNOTSUPP;
- val.intval = 1000 * mA;
- ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
+ dwc->vbus_draw_current = mA;
+ schedule_work(&dwc->vbus_draw_work);
- return ret;
+ return 0;
}
/**
--
2.34.1On Thu, Jan 29, 2026 at 7:16 PM Prashanth K
<prashanth.k@oss.qualcomm.com> wrote:
>
> Currently dwc3_gadget_vbus_draw() can be called from atomic
> context, which in turn invokes power-supply-core APIs. And
> some these PMIC APIs have operations that may sleep, leading
> to kernel panic.
>
> Fix this by moving the vbus_draw into a workqueue context.
>
> Fixes: 66e0ea341a2a ("usb: dwc3: core: Defer the probe until USB power supply ready")
I think the following patch is the one to fix:
https://lore.kernel.org/all/20210222115149.3606776-3-raychi@google.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
> ---
> drivers/usb/dwc3/core.c | 19 ++++++++++++++++++-
> drivers/usb/dwc3/core.h | 4 ++++
> drivers/usb/dwc3/gadget.c | 8 +++-----
> 3 files changed, 25 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index f32b67bf73a4..c9af126b9695 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2155,6 +2155,20 @@ static int dwc3_get_num_ports(struct dwc3 *dwc)
> return 0;
> }
>
> +static void dwc3_vbus_draw_work(struct work_struct *work)
> +{
> + struct dwc3 *dwc = container_of(work, struct dwc3, vbus_draw_work);
> + union power_supply_propval val = {0};
> + int ret;
> +
> + val.intval = 1000 * (dwc->vbus_draw_current);
> + ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> +
> + if (ret < 0)
> + dev_dbg(dwc->dev, "Error (%d) setting vbus draw (%d mA)\n",
> + ret, dwc->vbus_draw_current);
> +}
> +
> static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> {
> struct power_supply *usb_psy;
> @@ -2169,6 +2183,7 @@ static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> if (!usb_psy)
> return ERR_PTR(-EPROBE_DEFER);
>
> + INIT_WORK(&dwc->vbus_draw_work, dwc3_vbus_draw_work);
> return usb_psy;
> }
>
> @@ -2395,8 +2410,10 @@ void dwc3_core_remove(struct dwc3 *dwc)
>
> dwc3_free_event_buffers(dwc);
>
> - if (dwc->usb_psy)
> + if (dwc->usb_psy) {
> + cancel_work_sync(&dwc->vbus_draw_work);
> power_supply_put(dwc->usb_psy);
> + }
> }
> EXPORT_SYMBOL_GPL(dwc3_core_remove);
>
> diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
> index 08cc6f2b5c23..052fb18c6b5c 100644
> --- a/drivers/usb/dwc3/core.h
> +++ b/drivers/usb/dwc3/core.h
> @@ -1178,6 +1178,8 @@ struct dwc3_glue_ops {
> * @wakeup_pending_funcs: Indicates whether any interface has requested for
> * function wakeup in bitmap format where bit position
> * represents interface_id.
> + * @vbus_draw_work: Workqueue used for scheduling vbus draw work
> + * @vbus_draw_current: How much current to draw from vbus, in milliAmperes.
> */
> struct dwc3 {
> struct work_struct drd_work;
> @@ -1413,6 +1415,8 @@ struct dwc3 {
> struct dentry *debug_root;
> u32 gsbuscfg0_reqinfo;
> u32 wakeup_pending_funcs;
> + struct work_struct vbus_draw_work;
> + unsigned int vbus_draw_current;
> };
>
> #define INCRX_BURST_MODE 0
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 9355c952c140..03d8a3a151e0 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3124,8 +3124,6 @@ static void dwc3_gadget_set_ssp_rate(struct usb_gadget *g,
> static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> {
> struct dwc3 *dwc = gadget_to_dwc(g);
> - union power_supply_propval val = {0};
> - int ret;
>
> if (dwc->usb2_phy)
> return usb_phy_set_power(dwc->usb2_phy, mA);
> @@ -3133,10 +3131,10 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> if (!dwc->usb_psy)
> return -EOPNOTSUPP;
>
> - val.intval = 1000 * mA;
> - ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> + dwc->vbus_draw_current = mA;
> + schedule_work(&dwc->vbus_draw_work);
>
> - return ret;
> + return 0;
> }
>
> /**
> --
> 2.34.1
>
>
On 2/4/2026 9:29 AM, Kyle Tso wrote:
> On Thu, Jan 29, 2026 at 7:16 PM Prashanth K
> <prashanth.k@oss.qualcomm.com> wrote:
>>
>> Currently dwc3_gadget_vbus_draw() can be called from atomic
>> context, which in turn invokes power-supply-core APIs. And
>> some these PMIC APIs have operations that may sleep, leading
>> to kernel panic.
>>
>> Fix this by moving the vbus_draw into a workqueue context.
>>
>> Fixes: 66e0ea341a2a ("usb: dwc3: core: Defer the probe until USB power supply ready")
>
> I think the following patch is the one to fix:
>
> https://lore.kernel.org/all/20210222115149.3606776-3-raychi@google.com/
>
Yes agreed, i added 66e0ea341a2a because it can be backported without
conflicts only till 66e0ea341a2a, but I'll change it to the correct one.
Thanks for confirming,
Prashanth K
On Thu, Jan 29, 2026, Prashanth K wrote:
> Currently dwc3_gadget_vbus_draw() can be called from atomic
> context, which in turn invokes power-supply-core APIs. And
> some these PMIC APIs have operations that may sleep, leading
> to kernel panic.
>
> Fix this by moving the vbus_draw into a workqueue context.
>
> Fixes: 66e0ea341a2a ("usb: dwc3: core: Defer the probe until USB power supply ready")
> Cc: stable@vger.kernel.org
> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
> ---
> drivers/usb/dwc3/core.c | 19 ++++++++++++++++++-
> drivers/usb/dwc3/core.h | 4 ++++
> drivers/usb/dwc3/gadget.c | 8 +++-----
> 3 files changed, 25 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index f32b67bf73a4..c9af126b9695 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2155,6 +2155,20 @@ static int dwc3_get_num_ports(struct dwc3 *dwc)
> return 0;
> }
>
> +static void dwc3_vbus_draw_work(struct work_struct *work)
> +{
> + struct dwc3 *dwc = container_of(work, struct dwc3, vbus_draw_work);
> + union power_supply_propval val = {0};
> + int ret;
> +
> + val.intval = 1000 * (dwc->vbus_draw_current);
> + ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> +
> + if (ret < 0)
> + dev_dbg(dwc->dev, "Error (%d) setting vbus draw (%d mA)\n",
> + ret, dwc->vbus_draw_current);
> +}
> +
> static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> {
> struct power_supply *usb_psy;
> @@ -2169,6 +2183,7 @@ static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> if (!usb_psy)
> return ERR_PTR(-EPROBE_DEFER);
>
> + INIT_WORK(&dwc->vbus_draw_work, dwc3_vbus_draw_work);
> return usb_psy;
> }
>
> @@ -2395,8 +2410,10 @@ void dwc3_core_remove(struct dwc3 *dwc)
>
> dwc3_free_event_buffers(dwc);
>
> - if (dwc->usb_psy)
> + if (dwc->usb_psy) {
> + cancel_work_sync(&dwc->vbus_draw_work);
> power_supply_put(dwc->usb_psy);
> + }
> }
> EXPORT_SYMBOL_GPL(dwc3_core_remove);
>
> diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
> index 08cc6f2b5c23..052fb18c6b5c 100644
> --- a/drivers/usb/dwc3/core.h
> +++ b/drivers/usb/dwc3/core.h
> @@ -1178,6 +1178,8 @@ struct dwc3_glue_ops {
> * @wakeup_pending_funcs: Indicates whether any interface has requested for
> * function wakeup in bitmap format where bit position
> * represents interface_id.
> + * @vbus_draw_work: Workqueue used for scheduling vbus draw work
This is "work" and not workqueue, and it's used to set the vbus drawing
limit. Move this below usb_psy.
> + * @vbus_draw_current: How much current to draw from vbus, in milliAmperes.
Can we rename this to current_limit to match the setting name? And move
this along with the above.
The rest looks fine to me.
Thanks,
Thinh
> */
> struct dwc3 {
> struct work_struct drd_work;
> @@ -1413,6 +1415,8 @@ struct dwc3 {
> struct dentry *debug_root;
> u32 gsbuscfg0_reqinfo;
> u32 wakeup_pending_funcs;
> + struct work_struct vbus_draw_work;
> + unsigned int vbus_draw_current;
> };
>
> #define INCRX_BURST_MODE 0
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 9355c952c140..03d8a3a151e0 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3124,8 +3124,6 @@ static void dwc3_gadget_set_ssp_rate(struct usb_gadget *g,
> static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> {
> struct dwc3 *dwc = gadget_to_dwc(g);
> - union power_supply_propval val = {0};
> - int ret;
>
> if (dwc->usb2_phy)
> return usb_phy_set_power(dwc->usb2_phy, mA);
> @@ -3133,10 +3131,10 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> if (!dwc->usb_psy)
> return -EOPNOTSUPP;
>
> - val.intval = 1000 * mA;
> - ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> + dwc->vbus_draw_current = mA;
> + schedule_work(&dwc->vbus_draw_work);
>
> - return ret;
> + return 0;
> }
>
> /**
> --
> 2.34.1
>
On Thu, Jan 29, 2026 at 3:14 AM Prashanth K
<prashanth.k@oss.qualcomm.com> wrote:
>
> Currently dwc3_gadget_vbus_draw() can be called from atomic
> context, which in turn invokes power-supply-core APIs. And
> some these PMIC APIs have operations that may sleep, leading
> to kernel panic.
>
> Fix this by moving the vbus_draw into a workqueue context.
>
> Fixes: 66e0ea341a2a ("usb: dwc3: core: Defer the probe until USB power supply ready")
> Cc: stable@vger.kernel.org
> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
> ---
> drivers/usb/dwc3/core.c | 19 ++++++++++++++++++-
> drivers/usb/dwc3/core.h | 4 ++++
> drivers/usb/dwc3/gadget.c | 8 +++-----
> 3 files changed, 25 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index f32b67bf73a4..c9af126b9695 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2155,6 +2155,20 @@ static int dwc3_get_num_ports(struct dwc3 *dwc)
> return 0;
> }
>
> +static void dwc3_vbus_draw_work(struct work_struct *work)
> +{
> + struct dwc3 *dwc = container_of(work, struct dwc3, vbus_draw_work);
> + union power_supply_propval val = {0};
> + int ret;
> +
> + val.intval = 1000 * (dwc->vbus_draw_current);
> + ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> +
> + if (ret < 0)
> + dev_dbg(dwc->dev, "Error (%d) setting vbus draw (%d mA)\n",
> + ret, dwc->vbus_draw_current);
> +}
> +
> static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> {
> struct power_supply *usb_psy;
> @@ -2169,6 +2183,7 @@ static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> if (!usb_psy)
> return ERR_PTR(-EPROBE_DEFER);
>
> + INIT_WORK(&dwc->vbus_draw_work, dwc3_vbus_draw_work);
> return usb_psy;
> }
>
> @@ -2395,8 +2410,10 @@ void dwc3_core_remove(struct dwc3 *dwc)
>
> dwc3_free_event_buffers(dwc);
>
> - if (dwc->usb_psy)
> + if (dwc->usb_psy) {
> + cancel_work_sync(&dwc->vbus_draw_work);
> power_supply_put(dwc->usb_psy);
> + }
> }
> EXPORT_SYMBOL_GPL(dwc3_core_remove);
>
> diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
> index 08cc6f2b5c23..052fb18c6b5c 100644
> --- a/drivers/usb/dwc3/core.h
> +++ b/drivers/usb/dwc3/core.h
> @@ -1178,6 +1178,8 @@ struct dwc3_glue_ops {
> * @wakeup_pending_funcs: Indicates whether any interface has requested for
> * function wakeup in bitmap format where bit position
> * represents interface_id.
> + * @vbus_draw_work: Workqueue used for scheduling vbus draw work
> + * @vbus_draw_current: How much current to draw from vbus, in milliAmperes.
> */
> struct dwc3 {
> struct work_struct drd_work;
> @@ -1413,6 +1415,8 @@ struct dwc3 {
> struct dentry *debug_root;
> u32 gsbuscfg0_reqinfo;
> u32 wakeup_pending_funcs;
> + struct work_struct vbus_draw_work;
> + unsigned int vbus_draw_current;
> };
>
> #define INCRX_BURST_MODE 0
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 9355c952c140..03d8a3a151e0 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3124,8 +3124,6 @@ static void dwc3_gadget_set_ssp_rate(struct usb_gadget *g,
> static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> {
> struct dwc3 *dwc = gadget_to_dwc(g);
> - union power_supply_propval val = {0};
> - int ret;
>
> if (dwc->usb2_phy)
> return usb_phy_set_power(dwc->usb2_phy, mA);
> @@ -3133,10 +3131,10 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> if (!dwc->usb_psy)
> return -EOPNOTSUPP;
>
> - val.intval = 1000 * mA;
> - ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> + dwc->vbus_draw_current = mA;
> + schedule_work(&dwc->vbus_draw_work);
>
> - return ret;
> + return 0;
> }
>
> /**
> --
> 2.34.1
>
On Pixel 6 with this patch applied on 6.19-rc7, I am no longer seeing
the following lockdep:
[ BUG: Invalid wait context ]
6.19.0-rc7-mainline-maybe-dirty-4k #1 Tainted: G W O
-----------------------------
irq/360-dwc3/1244 is trying to lock:
ffffff8018110eb8 (&psy->extensions_sem){.+.+}-{3:3}, at:
__power_supply_set_property+0x40/0x180
other info that might help us debug this:
context-{4:4}
1 lock held by irq/360-dwc3/1244:
#0: ffffff80368d78f8 (&gi->spinlock){....}-{2:2}, at:
configfs_composite_suspend+0x28/0x68
stack backtrace:
goodixfp: Succeed to open device. irq = 417
CPU: 0 UID: 0 PID: 1244 Comm: irq/360-dwc3 Tainted: G W O
6.19.0-rc7-mainline-maybe-dirty-4k #1 PREEMPT
Tainted: [W]=WARN, [O]=OOT_MODULE
Hardware name: Oriole EVT 1.0 (DT)
Call trace:
show_stack+0x18/0x28 (C)
__dump_stack+0x28/0x3c
dump_stack_lvl+0xac/0xf0
dump_stack+0x18/0x3c
__lock_acquire+0x794/0x2b08
lock_acquire+0x138/0x2c4
down_read+0x3c/0x17c
__power_supply_set_property+0x40/0x180
power_supply_set_property+0x14/0x20
dwc3_gadget_vbus_draw+0x8c/0xcc
usb_gadget_vbus_draw+0x48/0x128
composite_suspend+0xcc/0xe4
configfs_composite_suspend+0x44/0x68
dwc3_thread_interrupt+0x7b4/0xc7c
irq_thread_fn+0x48/0xa8
irq_thread+0x16c/0x338
kthread+0x150/0x280
ret_from_fork+0x10/0x20
Tested-by: Samuel Wu <wusamuel@google.com>
© 2016 - 2026 Red Hat, Inc.