Re: [PATCH] usb: dwc3: fix use of destroyed dwc->connect_mutex on gadget exit

[Thinh Nguyen]

On Thu, Oct 01, 2026, Marek Szyprowski wrote:
> dwc3_gadget_exit() destroys dwc->connect_mutex before calling
> usb_del_gadget(), which unbinds the gadget driver and ends up in
> dwc3_gadget_pullup() taking that already destroyed mutex. With
> CONFIG_DEBUG_MUTEXES this triggers the following warning on reboot:
> 
>  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
>  WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x4bc/0xb88, CPU#1: systemd-shutdow/1
>  ...
>  Call trace:
>   __mutex_lock+0x4bc/0xb88 (P)
>   mutex_lock_nested+0x24/0x30
>   dwc3_gadget_pullup+0x88/0x150
>   usb_gadget_disconnect_locked+0x44/0x1f0
>   gadget_unbind_driver+0x48/0x124
>   device_remove+0x4c/0x80
>   device_release_driver_internal+0x1e0/0x23c
>   device_release_driver+0x18/0x24
>   bus_remove_device+0xe8/0x1a0
>   device_del+0x14c/0x414
>   usb_del_gadget+0x90/0xe8
>   dwc3_gadget_exit+0x40/0x9c
>   dwc3_drd_exit+0xe4/0x14c
>   dwc3_core_remove+0x140/0x17c
>   dwc3_qcom_remove+0x38/0x120
>   platform_shutdown+0x24/0x34
>   device_shutdown+0x158/0x260
>   kernel_restart+0x44/0xa4
>   __do_sys_reboot+0x118/0x24c
>   ...
> 
> Fix this by initializing dwc->connect_mutex together with dwc->mutex in
> dwc3_core_probe().
> 
> Fixes: 1ff77cbefe5a ("usb: dwc3: gadget: fix IRQ storm on invalid event buffer count")
> Assisted-by: Claude Opus 5.5 <noreply@xxxxxxxxxxxxx>
> Signed-off-by: Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>
> ---
>  drivers/usb/dwc3/core.c   | 1 +
>  drivers/usb/dwc3/gadget.c | 2 --
>  2 files changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index fd5c2cd36c59..f977bc3eeb79 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2373,6 +2373,7 @@ int dwc3_core_probe(const struct dwc3_probe_data *data)
>  	}
>  
>  	mutex_init(&dwc->mutex);
> +	mutex_init(&dwc->connect_mutex);
>  
>  	pm_runtime_get_noresume(dev);
>  	pm_runtime_set_active(dev);
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index ee837235630a..8fd1fd9b0db3 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -4879,7 +4879,6 @@ int dwc3_gadget_init(struct dwc3 *dwc)
>  
>  	init_completion(&dwc->ep0_in_setup);
>  	INIT_WORK(&dwc->err_recovery_work, dwc3_err_recovery_work);
> -	mutex_init(&dwc->connect_mutex);
>  	dwc->gadget = kzalloc_obj(struct usb_gadget);
>  	if (!dwc->gadget) {
>  		ret = -ENOMEM;
> @@ -4977,7 +4976,6 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
>  		return;
>  
>  	cancel_work_sync(&dwc->err_recovery_work);
> -	mutex_destroy(&dwc->connect_mutex);
>  	dwc3_enable_susphy(dwc, true);
>  	usb_del_gadget(dwc->gadget);
>  	dwc3_gadget_free_endpoints(dwc);
> -- 
> 2.43.0
> 

Acked-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>

Thanks for the catch.

BR,
Thinh