Re: [PATCH v4] usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

[Thinh Nguyen]

Hi,

On Mon, Sep 07, 2026, Jiazi Liu wrote:
> When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the
> event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check
> that event count does not exceed event buffer length") returns IRQ_NONE
> without writing back GEVNTCOUNT. Since the DWC3 interrupt is
> level-triggered, the uncleared IRQ source keeps the line asserted,
> causing a tight IRQ storm that accumulates 99,900 unhandled interrupts
> and triggers spurious.c:184 BUG -> kernel panic.
> 
> The resulting call stack:
>   __report_bad_irq+0xac/0xc8
>   note_interrupt+0x340/0x468
>   handle_irq_event+0xac/0xc0
>   handle_fasteoi_irq+0x120/0x228
>   gic_handle_irq+0x68/0x108
>   ...
>   kernel BUG at kernel/irq/spurious.c:184
> 
> To reproduce, write a bogus value exceeding the event buffer length
> directly to the GEVNTCOUNT register:
> 
>   devmem <DWC3_BASE + 0xc40c> 4 0x1004
> 
> Write the bogus count back to GEVNTCOUNT to clear the IRQ source,
> consistent with the stale event clearing pattern in
> dwc3_event_buffers_setup(), and schedule error recovery to
> reinitialize the controller.
> 
> Fixes: 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
> Signed-off-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>

Please remove my Co-developed-by or Signed-off-by tags.

You can add this:

Suggested-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>


[...]

One of my test bots reported a potential race involving
err_recovery_count updates between dwc3_err_recovery_work()
and the reset interrupt handler.

Can we adjust it as follows?

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 13096ee475d3..ee837235630a 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -4790,8 +4790,6 @@ static void dwc3_err_recovery_work(struct work_struct *work)
 	unsigned long flags;
 	int ret;
 
-	dwc->err_recovery_count++;
-
 	/* serializes against dwc3_gadget_pullup() */
 	mutex_lock(&dwc->connect_mutex);
 
@@ -4802,10 +4800,8 @@ static void dwc3_err_recovery_work(struct work_struct *work)
 	if (ret)
 		goto err_unrecoverable;
 
-	if (dwc->err_recovery_count > DWC3_ERR_RECOVERY_MAX)
-		goto err_unrecoverable;
-
 	if (dwc->softconnect) {
+		u32 count;
 		/*
 		 * Wait irq to finish before soft_connect resets evt->lpos and
 		 * the event buffer registers to avoid racing with
@@ -4813,6 +4809,13 @@ static void dwc3_err_recovery_work(struct work_struct *work)
 		 */
 		synchronize_irq(dwc->irq_gadget);
 
+		spin_lock_irqsave(&dwc->lock, flags);
+		count = ++dwc->err_recovery_count;
+		spin_unlock_irqrestore(&dwc->lock, flags);
+
+		if (count > DWC3_ERR_RECOVERY_MAX)
+			goto err_unrecoverable;
+
 		ret = dwc3_gadget_soft_connect(dwc);
 		if (ret)
 			goto err_unrecoverable;

---

Thanks,
Thinh