Re: [PATCH] usb: dwc3: gadget: cancel NoStream work before endpoint teardown
Thinh Nguyen <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.linux-usb |
|---|---|
| Message-ID | <anZW8H1kQfwXW2Ix@vbox> |
On Fri, Aug 07, 2026, Radhey Shyam Pandey wrote:
> DEPEVT_STREAM_NOSTREAM schedules dwc3_nostream_work() with a 100 ms delay.
> Neither dwc3_gadget_ep_disable() nor dwc3_gadget_free_endpoints() cancel
> this work before freeing struct dwc3_ep, so the handler may run after
> kfree(dep) during DRD/OTG role switch teardown.
>
> To fix it cancel the delayed work synchronously in both paths before
> disable or free the endpoint.
>
> Assisted-by: claude-mythos-preview-high
> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
> Cc: [email protected]
> Signed-off-by: Radhey Shyam Pandey <[email protected]>
> ---
> drivers/usb/dwc3/gadget.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index fa0f16ffafef..ddf1e262e2aa 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -1175,6 +1175,8 @@ static int dwc3_gadget_ep_disable(struct usb_ep *ep)
> dep->name))
> return 0;
>
> + cancel_delayed_work_sync(&dep->nostream_work);
> +
We may not sleep during dwc3_gadget_ep_disable() and we shouldn't call
*_sync() here.
> spin_lock_irqsave(&dwc->lock, flags);
> ret = __dwc3_gadget_ep_disable(dep);
> spin_unlock_irqrestore(&dwc->lock, flags);
> @@ -3508,6 +3510,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
> }
>
> dwc3_debugfs_remove_endpoint_dir(dep);
> + cancel_delayed_work_sync(&dep->nostream_work);
Just this here is sufficient.
> kfree(dep);
> }
> }
>
> base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
> --
> 2.44.4
>
Pei Xiao already submitted a patch for this:
https://lore.kernel.org/linux-usb/331d1d5133496d2b4184e05f8848adb06930a138.1785893865.git.xiaopei01@kylinos.cn/T/#u
BR,
Thinh