dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
wakeup timer.  dwc2_hcd_free() currently deletes the timer only after
freeing host-owned state, and timer_delete() does not synchronize a
callback or prevent it from being queued again.

Stop and shut down the timer in dwc2_hcd_release(), before the HCD
resources are freed.  This covers both the HCD initialization error path
and normal HCD removal.

Fixes: 7359d482eb4d ("staging: HCD files for the DWC2 driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 2414291aa..cd0dc876b 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -5082,14 +5082,13 @@ static void dwc2_hcd_free(struct dwc2_hsotg *hsotg)
 	}
 
 	cancel_work_sync(&hsotg->phy_reset_work);
-
-	timer_delete(&hsotg->wkp_timer);
 }
 
 static void dwc2_hcd_release(struct dwc2_hsotg *hsotg)
 {
 	/* Turn off all host-specific interrupts */
 	dwc2_disable_host_interrupts(hsotg);
+	timer_shutdown_sync(&hsotg->wkp_timer);
 
 	dwc2_hcd_free(hsotg);
 }
-- 
2.34.1

On Fri, Sep 04, 2026, Runyu Xiao wrote:
> dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the
> wakeup timer.  dwc2_hcd_free() currently deletes the timer only after
> freeing host-owned state, and timer_delete() does not synchronize a
> callback or prevent it from being queued again.
> 
> Stop and shut down the timer in dwc2_hcd_release(), before the HCD
> resources are freed.  This covers both the HCD initialization error path
> and normal HCD removal.
> 
> Fixes: 7359d482eb4d ("staging: HCD files for the DWC2 driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> 
> diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
> index 2414291aa..cd0dc876b 100644
> --- a/drivers/usb/dwc2/hcd.c
> +++ b/drivers/usb/dwc2/hcd.c
> @@ -5082,14 +5082,13 @@ static void dwc2_hcd_free(struct dwc2_hsotg *hsotg)
>  	}
>  
>  	cancel_work_sync(&hsotg->phy_reset_work);
> -
> -	timer_delete(&hsotg->wkp_timer);
>  }
>  
>  static void dwc2_hcd_release(struct dwc2_hsotg *hsotg)
>  {
>  	/* Turn off all host-specific interrupts */
>  	dwc2_disable_host_interrupts(hsotg);
> +	timer_shutdown_sync(&hsotg->wkp_timer);
>  
>  	dwc2_hcd_free(hsotg);
>  }
> -- 
> 2.34.1
> 
> 

Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

BR,
Thinh