Re: [PATCH v4] usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

Hi,

On Mon, Sep 07, 2026, Jiazi Liu wrote:

When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the
event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check
that event count does not exceed event buffer length") returns IRQ_NONE
without writing back GEVNTCOUNT. Since the DWC3 interrupt is
level-triggered, the uncleared IRQ source keeps the line asserted,
causing a tight IRQ storm that accumulates 99,900 unhandled interrupts
and triggers spurious.c:184 BUG -> kernel panic.

The resulting call stack:
  __report_bad_irq+0xac/0xc8
  note_interrupt+0x340/0x468
  handle_irq_event+0xac/0xc0
  handle_fasteoi_irq+0x120/0x228
  gic_handle_irq+0x68/0x108
  ...
  kernel BUG at kernel/irq/spurious.c:184

To reproduce, write a bogus value exceeding the event buffer length
directly to the GEVNTCOUNT register:

  devmem <DWC3_BASE + 0xc40c> 4 0x1004

Write the bogus count back to GEVNTCOUNT to clear the IRQ source,
consistent with the stale event clearing pattern in
dwc3_event_buffers_setup(), and schedule error recovery to
reinitialize the controller.

Fixes: 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length")
Cc: stable@vger.kernel.org
Co-developed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

Please remove my Co-developed-by or Signed-off-by tags.

You can add this:

Suggested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>


[...]

One of my test bots reported a potential race involving
err_recovery_count updates between dwc3_err_recovery_work()
and the reset interrupt handler.

Can we adjust it as follows?

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 13096ee475d3..ee837235630a 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c

@@ -4790,8 +4790,6 @@ static void dwc3_err_recovery_work(struct work_struct *work)
 	unsigned long flags;
 	int ret;
 
-	dwc->err_recovery_count++;
-
 	/* serializes against dwc3_gadget_pullup() */
 	mutex_lock(&dwc->connect_mutex);
 

@@ -4802,10 +4800,8 @@ static void dwc3_err_recovery_work(struct work_struct *work)
 	if (ret)
 		goto err_unrecoverable;
 
-	if (dwc->err_recovery_count > DWC3_ERR_RECOVERY_MAX)
-		goto err_unrecoverable;
-
 	if (dwc->softconnect) {
+		u32 count;
 		/*
 		 * Wait irq to finish before soft_connect resets evt->lpos and
 		 * the event buffer registers to avoid racing with

@@ -4813,6 +4809,13 @@ static void dwc3_err_recovery_work(struct work_struct *work)
 		 */
 		synchronize_irq(dwc->irq_gadget);
 
+		spin_lock_irqsave(&dwc->lock, flags);
+		count = ++dwc->err_recovery_count;
+		spin_unlock_irqrestore(&dwc->lock, flags);
+
+		if (count > DWC3_ERR_RECOVERY_MAX)
+			goto err_unrecoverable;
+
 		ret = dwc3_gadget_soft_connect(dwc);
 		if (ret)
 			goto err_unrecoverable;

---

Thanks,
Thinh