[PATCH] usb: dwc3: fix use of destroyed dwc->connect_mutex on gadget exit

[PATCH] usb: dwc3: fix use of destroyed dwc->connect_mutex on gadget exit

[Marek Szyprowski]

dwc3_gadget_exit() destroys dwc->connect_mutex before calling
usb_del_gadget(), which unbinds the gadget driver and ends up in
dwc3_gadget_pullup() taking that already destroyed mutex. With
CONFIG_DEBUG_MUTEXES this triggers the following warning on reboot:

 DEBUG_LOCKS_WARN_ON(lock->magic != lock)
 WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x4bc/0xb88, CPU#1: systemd-shutdow/1
 ...
 Call trace:
  __mutex_lock+0x4bc/0xb88 (P)
  mutex_lock_nested+0x24/0x30
  dwc3_gadget_pullup+0x88/0x150
  usb_gadget_disconnect_locked+0x44/0x1f0
  gadget_unbind_driver+0x48/0x124
  device_remove+0x4c/0x80
  device_release_driver_internal+0x1e0/0x23c
  device_release_driver+0x18/0x24
  bus_remove_device+0xe8/0x1a0
  device_del+0x14c/0x414
  usb_del_gadget+0x90/0xe8
  dwc3_gadget_exit+0x40/0x9c
  dwc3_drd_exit+0xe4/0x14c
  dwc3_core_remove+0x140/0x17c
  dwc3_qcom_remove+0x38/0x120
  platform_shutdown+0x24/0x34
  device_shutdown+0x158/0x260
  kernel_restart+0x44/0xa4
  __do_sys_reboot+0x118/0x24c
  ...

Fix this by initializing dwc->connect_mutex together with dwc->mutex in
dwc3_core_probe().

Fixes: 1ff77cbefe5a ("usb: dwc3: gadget: fix IRQ storm on invalid event buffer count")
Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
---
 drivers/usb/dwc3/core.c   | 1 +
 drivers/usb/dwc3/gadget.c | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index fd5c2cd36c59..f977bc3eeb79 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -2373,6 +2373,7 @@ int dwc3_core_probe(const struct dwc3_probe_data *data)
 	}
 
 	mutex_init(&dwc->mutex);
+	mutex_init(&dwc->connect_mutex);
 
 	pm_runtime_get_noresume(dev);
 	pm_runtime_set_active(dev);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index ee837235630a..8fd1fd9b0db3 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -4879,7 +4879,6 @@ int dwc3_gadget_init(struct dwc3 *dwc)
 
 	init_completion(&dwc->ep0_in_setup);
 	INIT_WORK(&dwc->err_recovery_work, dwc3_err_recovery_work);
-	mutex_init(&dwc->connect_mutex);
 	dwc->gadget = kzalloc_obj(struct usb_gadget);
 	if (!dwc->gadget) {
 		ret = -ENOMEM;
@@ -4977,7 +4976,6 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 		return;
 
 	cancel_work_sync(&dwc->err_recovery_work);
-	mutex_destroy(&dwc->connect_mutex);
 	dwc3_enable_susphy(dwc, true);
 	usb_del_gadget(dwc->gadget);
 	dwc3_gadget_free_endpoints(dwc);
-- 
2.43.0

Re: [PATCH] usb: dwc3: fix use of destroyed dwc->connect_mutex on gadget exit

[Thinh Nguyen]

On Thu, Oct 01, 2026, Marek Szyprowski wrote:
> dwc3_gadget_exit() destroys dwc->connect_mutex before calling
> usb_del_gadget(), which unbinds the gadget driver and ends up in
> dwc3_gadget_pullup() taking that already destroyed mutex. With
> CONFIG_DEBUG_MUTEXES this triggers the following warning on reboot:
> 
>  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
>  WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x4bc/0xb88, CPU#1: systemd-shutdow/1
>  ...
>  Call trace:
>   __mutex_lock+0x4bc/0xb88 (P)
>   mutex_lock_nested+0x24/0x30
>   dwc3_gadget_pullup+0x88/0x150
>   usb_gadget_disconnect_locked+0x44/0x1f0
>   gadget_unbind_driver+0x48/0x124
>   device_remove+0x4c/0x80
>   device_release_driver_internal+0x1e0/0x23c
>   device_release_driver+0x18/0x24
>   bus_remove_device+0xe8/0x1a0
>   device_del+0x14c/0x414
>   usb_del_gadget+0x90/0xe8
>   dwc3_gadget_exit+0x40/0x9c
>   dwc3_drd_exit+0xe4/0x14c
>   dwc3_core_remove+0x140/0x17c
>   dwc3_qcom_remove+0x38/0x120
>   platform_shutdown+0x24/0x34
>   device_shutdown+0x158/0x260
>   kernel_restart+0x44/0xa4
>   __do_sys_reboot+0x118/0x24c
>   ...
> 
> Fix this by initializing dwc->connect_mutex together with dwc->mutex in
> dwc3_core_probe().
> 
> Fixes: 1ff77cbefe5a ("usb: dwc3: gadget: fix IRQ storm on invalid event buffer count")
> Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>
> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
>  drivers/usb/dwc3/core.c   | 1 +
>  drivers/usb/dwc3/gadget.c | 2 --
>  2 files changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index fd5c2cd36c59..f977bc3eeb79 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2373,6 +2373,7 @@ int dwc3_core_probe(const struct dwc3_probe_data *data)
>  	}
>  
>  	mutex_init(&dwc->mutex);
> +	mutex_init(&dwc->connect_mutex);
>  
>  	pm_runtime_get_noresume(dev);
>  	pm_runtime_set_active(dev);
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index ee837235630a..8fd1fd9b0db3 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -4879,7 +4879,6 @@ int dwc3_gadget_init(struct dwc3 *dwc)
>  
>  	init_completion(&dwc->ep0_in_setup);
>  	INIT_WORK(&dwc->err_recovery_work, dwc3_err_recovery_work);
> -	mutex_init(&dwc->connect_mutex);
>  	dwc->gadget = kzalloc_obj(struct usb_gadget);
>  	if (!dwc->gadget) {
>  		ret = -ENOMEM;
> @@ -4977,7 +4976,6 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
>  		return;
>  
>  	cancel_work_sync(&dwc->err_recovery_work);
> -	mutex_destroy(&dwc->connect_mutex);
>  	dwc3_enable_susphy(dwc, true);
>  	usb_del_gadget(dwc->gadget);
>  	dwc3_gadget_free_endpoints(dwc);
> -- 
> 2.43.0
> 

Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

Thanks for the catch.

BR,
Thinh