From nobody Fri Sep 25 23:51:08 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BBC941836B for ; Mon, 7 Sep 2026 07:38:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788766690; cv=none; b=JuTm6I180tW86SPZY9nQI8X1mmwjeUrAF372DjRxHXLakcfCJLuf9LuKWu5rF7H40ZQTeC9t7h37wugApeX+6W0nuSF1HH8lHovUL1IvzVXghRYVJBTGItCbK5Ly48WoF4bn2tmjhs1uctC9ojg5NrOYRdz5qqGYvJbV8UZE2TE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788766690; c=relaxed/simple; bh=l5S4g/u3F1+jk26vPXvbs6AoJQiUgTwPWMygcOeA42Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EKlmbohPnWpOsC2wkDKapbV1epC8OvbtOHUSZfDc0Vdl0jmAM+SIEz9gJr4HhxtueFjDKExlYLuu5zgdALx7SNqQar8QYOQXgvYbthoSxmRsgxz0P7WVlXdpqNPOxTteeKOWgeLGEP+xJ50rbiO7xeG7ZYKYJU3x5yBZYBjtgjs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=blwbNmF8; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="blwbNmF8" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cfbbdfa60bso28353055ad.3 for ; Mon, 07 Sep 2026 00:38:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788766686; x=1789371486; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PMcuolaGFO0gW0x/De/12yZ3mptABsllymh5XP5PN5g=; b=blwbNmF82OHpO0TE1VOo3IFvc37ylafnSlbD/rQoyjsgWEPARt8g6h3/++LGg8tkTn rCzfAumGYTq3tHOpzTiFPwrxX08qanINoAgXY+MbCGpN12hdhlxKVA3i4MFmt8PkVAH/ xYapU92JKGYbqMxDi7lWOZhzqZ95iSvhGOZu3aT3FRqtTMX8/154ZvJQcCxvA3nngHii t1DViJSFlMjLJlBwgCtBxqd0/iUUy5e9GZ+XKIw3f8Xcl5CkogZyhs6ejnJfkAbB0g50 WGLTBC3L/CIZKCwTYS0GNYrml1zyN1E7scdNO29mdt/rh0KaTd3qil9P3n06BXoc25kH t9gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788766686; x=1789371486; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PMcuolaGFO0gW0x/De/12yZ3mptABsllymh5XP5PN5g=; b=IWvR22dDn1BNNLahECKbHWv+EArHa9tq9tWtnpDP+UG8EOT7/k6VLjtB15JVEv9T4n 9dsK+97UKr1dAg9ZuMxtY8ZbVYCBlKQk14mrlPzUXvA6DkJhipWbtNn7Bhwgruyb1j6+ 3Jk7NFgyfSP4YzoX8kFqlw5jFP2knnN7Duoc1YlsS+gz8lLsQ8dk+mamjXYOsMGy5drD hrQXEZsfu07nWpOtjh3gRQycUK2CelpWG6JgzuVUHhQ3YV6pRKEC2c7q6kJyBzJdzT0F Oo4M0EEQUB3jRFMMbWiIGx9WbH2PU31pWeLYR3tQ1wwE7pLRQQVSCwSbpkvupbBYqbKF bHKQ== X-Forwarded-Encrypted: i=1; AKwUvByiujdd2c5F037/S6LdtGIEsAoSwFh0BJLnrg9SQpgYqOL6rWRess/ynz3YB7xuxiC0Uu6Ht9KlYVl7J64=@vger.kernel.org X-Gm-Message-State: AFuF++m+TpY7Pzumf0l/PYpk+LJcozGfTq0jPAthHgg/6JEt+phzVSJQ olgJHFAFIO1xAqGtC1Ey1Ne0WjpQlVe5Rr+Ewh1dXJAtv+j07as27jCZQ0abwbERRHY= X-Gm-Gg: AYBFou1EmU32x05WYM9Q6SlKEriRRjfc00hq/Fv9sEpxV0rkMYBUn9b4ToJUKM2pNRd iDkfai5Pk6Yf5298lEWFLFVUOOUT5Fi7p62aYhv7rq2UA7OReyXmF/4yeybeaWzpZhMntFLAOcm JyrarZVneCB5no0Kt+rKOTkje5uUETN4UAL0CyXmBhmW821dm7PkH3n8o92HV2DPPhoV3uRJYfz UmcBSuQai3pMJT1h8DE370gD5/zedxCx8Oc7lgMmKvk39FpCrHcXP97TLqS31r5pn8k5uFwIr6X ts8e9QT8ri4Ur0/dc3Vi0kAiJn0IOK57eYp1dgb+33XXlKebCMXbtSA43j3+OjyRSLXRpQ6UkO9 BNtZzoy17pwXZTk+adOiijihmPbvgHBdQ4J6dgsADpfZIemgx8xp0OVskDmVrfAtLIwYOyqHk9s 5eHLCrrOgTTvhra/Ud/Igd8DKjFt4UUzXInGA1w/HgG0BN0LLIc5ByHfaxRl8FaLFLhfGHElOlw 9TosnGiDwYGy2HYCxhKb16aUCUOdQrItQflaHh3xO7t1CpEwFn3oGwFPDMnO9Nm1odEvApwumgT yRaPvS9s X-Received: by 2002:a17:903:3848:b0:2d9:56dd:f804 with SMTP id d9443c01a7336-2db125f00c7mr316773125ad.13.1788766686227; Mon, 07 Sep 2026 00:38:06 -0700 (PDT) Received: from 7cf34ddc0813.ant.amazon.com ([54.222.46.36]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2db1495b9f0sm40812925ad.20.2026.09.07.00.38.02 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 07 Sep 2026 00:38:05 -0700 (PDT) From: Jiazi Liu To: Thinh.Nguyen@synopsys.com, gregkh@linuxfoundation.org Cc: frode@meta.com, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Jiazi Liu Subject: [PATCH v4] usb: dwc3: gadget: fix IRQ storm on invalid event buffer count Date: Mon, 7 Sep 2026 15:37:56 +0800 Message-ID: <20260907073756.22329-1-jiazi.liu1984@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260727092258.1121-1-liujiazi@amazon.com> References: <20260727092258.1121-1-liujiazi@amazon.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length") returns IRQ_NONE without writing back GEVNTCOUNT. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source keeps the line asserted, causing a tight IRQ storm that accumulates 99,900 unhandled interrupts and triggers spurious.c:184 BUG -> kernel panic. The resulting call stack: __report_bad_irq+0xac/0xc8 note_interrupt+0x340/0x468 handle_irq_event+0xac/0xc0 handle_fasteoi_irq+0x120/0x228 gic_handle_irq+0x68/0x108 ... kernel BUG at kernel/irq/spurious.c:184 To reproduce, write a bogus value exceeding the event buffer length directly to the GEVNTCOUNT register: devmem 4 0x1004 Write the bogus count back to GEVNTCOUNT to clear the IRQ source, consistent with the stale event clearing pattern in dwc3_event_buffers_setup(), and schedule error recovery to reinitialize the controller. Fixes: 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not ex= ceed event buffer length") Cc: stable@vger.kernel.org Co-developed-by: Thinh Nguyen Signed-off-by: Thinh Nguyen Signed-off-by: Jiazi Liu Suggested-by: Thinh Nguyen --- drivers/usb/dwc3/core.h | 19 +++++++ drivers/usb/dwc3/ep0.c | 9 ++++ drivers/usb/dwc3/gadget.c | 105 +++++++++++++++++++++++++++++++++++++- 3 files changed, 131 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h index 608daeb7ef10..f3dabb37f806 100644 --- a/drivers/usb/dwc3/core.h +++ b/drivers/usb/dwc3/core.h @@ -49,6 +49,7 @@ #define DWC3_ENDPOINTS_NUM 32 #define DWC3_XHCI_RESOURCES_NUM 2 #define DWC3_ISOC_MAX_RETRIES 5 +#define DWC3_ERR_RECOVERY_MAX 3 =20 #define DWC3_SCRATCHBUF_SIZE 4096 /* each buffer is assumed to be 4KiB */ #define DWC3_EVENT_BUFFERS_SIZE 4096 @@ -841,6 +842,12 @@ enum dwc3_link_state { DWC3_LINK_STATE_MASK =3D 0x0f, }; =20 +enum dwc3_err_state { + DWC3_ERR_NONE =3D 0, + DWC3_ERR_RECOVERY, + DWC3_ERR_UNRECOVERABLE, +}; + /* TRB Length, PCM and Status */ #define DWC3_TRB_SIZE_MASK (0x00ffffff) #define DWC3_TRB_SIZE_LENGTH(n) ((n) & DWC3_TRB_SIZE_MASK) @@ -1004,6 +1011,7 @@ struct dwc3_glue_ops { /** * struct dwc3 - representation of our controller * @drd_work: workqueue used for role swapping + * @err_recovery_work: workqueue used for controller error recovery * @ep0_trb: trb which is used for the ctrl_req * @bounce: address of bounce buffer * @setup_buf: used while precessing STD USB requests @@ -1013,6 +1021,7 @@ struct dwc3_glue_ops { * @ep0_in_setup: one control transfer is completed and enter setup phase * @lock: for synchronizing * @mutex: for mode switching + * @connect_mutex: for the pull-up and err_recovery_work * @dev: pointer to our struct device * @sysdev: pointer to the DMA-capable device * @xhci: pointer to our xHCI child @@ -1079,6 +1088,9 @@ struct dwc3_glue_ops { * @ep0_next_event: hold the next expected event * @ep0state: state of endpoint zero * @link_state: link state + * @err_state: current error recovery state. + * @err_recovery_count: number of consecutive error recovery attempts until + * confirmed healthy and reset to 0 on reset event. * @speed: device speed (super, high, full, low) * @hwparams: copy of hwparams registers * @regset: debugfs pointer to regdump file @@ -1189,6 +1201,7 @@ struct dwc3_glue_ops { */ struct dwc3 { struct work_struct drd_work; + struct work_struct err_recovery_work; struct dwc3_trb *ep0_trb; void *bounce; u8 *setup_buf; @@ -1203,6 +1216,9 @@ struct dwc3 { /* mode switching lock */ struct mutex mutex; =20 + /* serializes pull-up run/stop vs error recovery */ + struct mutex connect_mutex; + struct device *dev; struct device *sysdev; =20 @@ -1332,6 +1348,9 @@ struct dwc3 { enum dwc3_ep0_next ep0_next_event; enum dwc3_ep0_state ep0state; enum dwc3_link_state link_state; + enum dwc3_err_state err_state; + + u32 err_recovery_count; =20 u16 u2sel; u16 u2pel; diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index bfe616194dfa..fa3d8b9f6f8e 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -200,6 +200,11 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct us= b_request *request, int ret; =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + ret =3D -ESHUTDOWN; + goto out; + } + if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) { dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n", dep->name); @@ -271,6 +276,10 @@ int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int va= lue) int ret; =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } ret =3D __dwc3_gadget_ep0_set_halt(ep, value); spin_unlock_irqrestore(&dwc->lock, flags); =20 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index fa0f16ffafef..2a051991220f 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1149,6 +1149,10 @@ static int dwc3_gadget_ep_enable(struct usb_ep *ep, return 0; =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } ret =3D __dwc3_gadget_ep_enable(dep, DWC3_DEPCFG_ACTION_INIT); spin_unlock_irqrestore(&dwc->lock, flags); =20 @@ -2055,6 +2059,10 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, s= truct usb_request *request, int ret; =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } ret =3D __dwc3_gadget_ep_queue(dep, req); spin_unlock_irqrestore(&dwc->lock, flags); =20 @@ -2287,6 +2295,10 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep= , int value) int ret; =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } ret =3D __dwc3_gadget_ep_set_halt(dep, value, false); spin_unlock_irqrestore(&dwc->lock, flags); =20 @@ -2301,6 +2313,10 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *e= p) int ret; =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } dep->flags |=3D DWC3_EP_WEDGE; =20 if (dep->number =3D=3D 0 || dep->number =3D=3D 1) @@ -2432,6 +2448,10 @@ static int dwc3_gadget_wakeup(struct usb_gadget *g) } =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } if (!dwc->gadget->wakeup_armed) { dev_err(dwc->dev, "not armed for remote wakeup\n"); spin_unlock_irqrestore(&dwc->lock, flags); @@ -2459,6 +2479,10 @@ static int dwc3_gadget_func_wakeup(struct usb_gadget= *g, int intf_id) } =20 spin_lock_irqsave(&dwc->lock, flags); + if (dwc->err_state !=3D DWC3_ERR_NONE) { + spin_unlock_irqrestore(&dwc->lock, flags); + return -ESHUTDOWN; + } /* * If the link is in U3, signal for remote wakeup and wait for the * link to transition to U0 before sending device notification. @@ -2828,10 +2852,13 @@ static int dwc3_gadget_pullup(struct usb_gadget *g,= int is_on) =20 synchronize_irq(dwc->irq_gadget); =20 + /* Serialize against dwc3_err_recovery_work() */ + mutex_lock(&dwc->connect_mutex); if (!is_on) ret =3D dwc3_gadget_soft_disconnect(dwc); else ret =3D dwc3_gadget_soft_connect(dwc); + mutex_unlock(&dwc->connect_mutex); =20 pm_runtime_put(dwc->dev); =20 @@ -4147,6 +4174,10 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 = *dwc) =20 dwc->suspended =3D false; =20 + /* The controller is recovered. */ + if (dwc->err_state =3D=3D DWC3_ERR_NONE) + dwc->err_recovery_count =3D 0; + /* * Ideally, dwc3_reset_gadget() would trigger the function * drivers to stop any active transfers through ep disable. @@ -4634,6 +4665,12 @@ static irqreturn_t dwc3_thread_interrupt(int irq, vo= id *_evt) return ret; } =20 +static void dwc3_schedule_err_recovery(struct dwc3 *dwc) +{ + dwc->err_state =3D DWC3_ERR_RECOVERY; + schedule_work(&dwc->err_recovery_work); +} + static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt) { struct dwc3 *dwc =3D evt->dwc; @@ -4667,9 +4704,21 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_= event_buffer *evt) return IRQ_NONE; =20 if (count > evt->length) { - dev_err_ratelimited(dwc->dev, "invalid count(%u) > evt->length(%u)\n", + dev_err(dwc->dev, "invalid count(%u) > evt->length(%u)\n", count, evt->length); - return IRQ_NONE; + /* + * This is a fatal error - the driver and controller are out of + * sync on which event has been consumed. Reinitializing the + * controller is required to recover. Write the bogus count back + * to GEVNTCOUNT to clear the IRQ source, consistent with the + * stale event clearing in dwc3_event_buffers_setup(), then + * schedule error recovery. + */ + spin_lock(&dwc->lock); + dwc3_schedule_err_recovery(dwc); + spin_unlock(&dwc->lock); + dwc3_writel(dwc, DWC3_GEVNTCOUNT(0), count); + return IRQ_HANDLED; } =20 evt->count =3D count; @@ -4729,6 +4778,54 @@ static void dwc_gadget_release(struct device *dev) kfree(gadget); } =20 +static void dwc3_err_recovery_work(struct work_struct *work) +{ + struct dwc3 *dwc =3D container_of(work, struct dwc3, err_recovery_work); + unsigned long flags; + int ret; + + dwc->err_recovery_count++; + + /* serializes against dwc3_gadget_pullup() */ + mutex_lock(&dwc->connect_mutex); + + ret =3D dwc3_gadget_soft_disconnect(dwc); + + dwc3_disconnect_gadget_sleepable(dwc); + + if (ret) + goto err_unrecoverable; + + if (dwc->err_recovery_count > DWC3_ERR_RECOVERY_MAX) + goto err_unrecoverable; + + if (dwc->softconnect) { + /* + * Wait irq to finish before soft_connect resets evt->lpos and + * the event buffer registers to avoid racing with + * dwc3_process_event_buf(). + */ + synchronize_irq(dwc->irq_gadget); + + ret =3D dwc3_gadget_soft_connect(dwc); + if (ret) + goto err_unrecoverable; + } + mutex_unlock(&dwc->connect_mutex); + + spin_lock_irqsave(&dwc->lock, flags); + dwc->err_state =3D DWC3_ERR_NONE; + spin_unlock_irqrestore(&dwc->lock, flags); + return; + +err_unrecoverable: + dev_err(dwc->dev, "Unable to recover the controller\n"); + mutex_unlock(&dwc->connect_mutex); + spin_lock_irqsave(&dwc->lock, flags); + dwc->err_state =3D DWC3_ERR_UNRECOVERABLE; + spin_unlock_irqrestore(&dwc->lock, flags); +} + /** * dwc3_gadget_init - initializes gadget related registers * @dwc: pointer to our controller context structure @@ -4772,6 +4869,8 @@ int dwc3_gadget_init(struct dwc3 *dwc) } =20 init_completion(&dwc->ep0_in_setup); + INIT_WORK(&dwc->err_recovery_work, dwc3_err_recovery_work); + mutex_init(&dwc->connect_mutex); dwc->gadget =3D kzalloc_obj(struct usb_gadget); if (!dwc->gadget) { ret =3D -ENOMEM; @@ -4868,6 +4967,8 @@ void dwc3_gadget_exit(struct dwc3 *dwc) if (!dwc->gadget) return; =20 + cancel_work_sync(&dwc->err_recovery_work); + mutex_destroy(&dwc->connect_mutex); dwc3_enable_susphy(dwc, true); usb_del_gadget(dwc->gadget); dwc3_gadget_free_endpoints(dwc); --=20 2.50.1 (Apple Git-155)