Re: [PATCH] usb: dwc3: host: fix props[] overflow and dangling xhci pointer on error

[Thinh Nguyen]

Hi,

On Fri, Sep 04, 2026, David Collin wrote:
> props[] is sized for exactly the number of properties dwc3_host_init()
> can populate, leaving no slot for the NULL terminator
> property_entries_dup() requires when usb3_lpm_capable,
> usb2_lpm_disable, and the <=3.00a PED quirk are all true. Size props[]
> for one more slot.
> 
> This also clears dwc->xhci on the error path and adds a NULL check in
> dwc3_host_exit(), since a failed dwc3_host_init() otherwise leaves a
> dangling pointer that dwc3_host_exit() dereferences unconditionally on
> removal/shutdown.
> 
> Fixes: 8da7644493b4 ("usb: dwc3: Specify maximum number of XHCI interrupters")
> 
> Signed-off-by: David Collin <davidcollin899@xxxxxxxxx>
> ---
>  drivers/usb/dwc3/host.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
> index c5674161b..cd1e5204a 100644
> --- a/drivers/usb/dwc3/host.c
> +++ b/drivers/usb/dwc3/host.c
> @@ -130,7 +130,7 @@ static int dwc3_host_get_irq(struct dwc3 *dwc)
>  
>  int dwc3_host_init(struct dwc3 *dwc)
>  {
> -	struct property_entry	props[6];
> +	struct property_entry	props[7];
>  	struct platform_device	*xhci;
>  	int			ret, irq;
>  	int			prop_idx = 0;
> @@ -219,12 +219,16 @@ int dwc3_host_init(struct dwc3 *dwc)
>  	return 0;
>  err:
>  	platform_device_put(xhci);
> +	dwc->xhci = NULL;
>  	return ret;
>  }
>  EXPORT_SYMBOL_GPL(dwc3_host_init);
>  
>  void dwc3_host_exit(struct dwc3 *dwc)
>  {
> +	if (!dwc->xhci)
> +		return;
> +
>  	if (dwc->sys_wakeup)
>  		device_init_wakeup(&dwc->xhci->dev, false);
>  
> -- 
> 2.55.0
> 
> 

These are two separate fixes. Can you split your change into separate
patches with the corresponding Fixes tag for each? Also, please add Cc
stable tag.

Thanks,
Thinh