[PATCH] usb: dwc3: gadget: cancel NoStream work before endpoint teardown

[PATCH] usb: dwc3: gadget: cancel NoStream work before endpoint teardown

[Radhey Shyam Pandey]

DEPEVT_STREAM_NOSTREAM schedules dwc3_nostream_work() with a 100 ms delay.
Neither dwc3_gadget_ep_disable() nor dwc3_gadget_free_endpoints() cancel
this work before freeing struct dwc3_ep, so the handler may run after
kfree(dep) during DRD/OTG role switch teardown.

To fix it cancel the delayed work synchronously in both paths before
disable or free the endpoint.

Assisted-by: claude-mythos-preview-high
Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
Cc: stable@vger.kernel.org
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
 drivers/usb/dwc3/gadget.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index fa0f16ffafef..ddf1e262e2aa 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1175,6 +1175,8 @@ static int dwc3_gadget_ep_disable(struct usb_ep *ep)
 					dep->name))
 		return 0;
 
+	cancel_delayed_work_sync(&dep->nostream_work);
+
 	spin_lock_irqsave(&dwc->lock, flags);
 	ret = __dwc3_gadget_ep_disable(dep);
 	spin_unlock_irqrestore(&dwc->lock, flags);
@@ -3508,6 +3510,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
 		}
 
 		dwc3_debugfs_remove_endpoint_dir(dep);
+		cancel_delayed_work_sync(&dep->nostream_work);
 		kfree(dep);
 	}
 }

base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
-- 
2.44.4

Re: [PATCH] usb: dwc3: gadget: cancel NoStream work before endpoint teardown

[Thinh Nguyen]

On Fri, Aug 07, 2026, Radhey Shyam Pandey wrote:
> DEPEVT_STREAM_NOSTREAM schedules dwc3_nostream_work() with a 100 ms delay.
> Neither dwc3_gadget_ep_disable() nor dwc3_gadget_free_endpoints() cancel
> this work before freeing struct dwc3_ep, so the handler may run after
> kfree(dep) during DRD/OTG role switch teardown.
> 
> To fix it cancel the delayed work synchronously in both paths before
> disable or free the endpoint.
> 
> Assisted-by: claude-mythos-preview-high
> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
> Cc: stable@vger.kernel.org
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
> ---
>  drivers/usb/dwc3/gadget.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index fa0f16ffafef..ddf1e262e2aa 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -1175,6 +1175,8 @@ static int dwc3_gadget_ep_disable(struct usb_ep *ep)
>  					dep->name))
>  		return 0;
>  
> +	cancel_delayed_work_sync(&dep->nostream_work);
> +

We may not sleep during dwc3_gadget_ep_disable() and we shouldn't call
*_sync() here.

>  	spin_lock_irqsave(&dwc->lock, flags);
>  	ret = __dwc3_gadget_ep_disable(dep);
>  	spin_unlock_irqrestore(&dwc->lock, flags);
> @@ -3508,6 +3510,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
>  		}
>  
>  		dwc3_debugfs_remove_endpoint_dir(dep);
> +		cancel_delayed_work_sync(&dep->nostream_work);

Just this here is sufficient.

>  		kfree(dep);
>  	}
>  }
> 
> base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
> -- 
> 2.44.4
> 

Pei Xiao already submitted a patch for this:
https://lore.kernel.org/linux-usb/331d1d5133496d2b4184e05f8848adb06930a138.1785893865.git.xiaopei01@kylinos.cn/T/#u

BR,
Thinh

Re: [PATCH] usb: dwc3: gadget: cancel NoStream work before endpoint teardown

[Pandey, Radhey Shyam]

On 8/8/2026 3:42 AM, Thinh Nguyen wrote:
> On Fri, Aug 07, 2026, Radhey Shyam Pandey wrote:
>> DEPEVT_STREAM_NOSTREAM schedules dwc3_nostream_work() with a 100 ms delay.
>> Neither dwc3_gadget_ep_disable() nor dwc3_gadget_free_endpoints() cancel
>> this work before freeing struct dwc3_ep, so the handler may run after
>> kfree(dep) during DRD/OTG role switch teardown.
>>
>> To fix it cancel the delayed work synchronously in both paths before
>> disable or free the endpoint.
>>
>> Assisted-by: claude-mythos-preview-high
>> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
>> ---
>>   drivers/usb/dwc3/gadget.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>> index fa0f16ffafef..ddf1e262e2aa 100644
>> --- a/drivers/usb/dwc3/gadget.c
>> +++ b/drivers/usb/dwc3/gadget.c
>> @@ -1175,6 +1175,8 @@ static int dwc3_gadget_ep_disable(struct usb_ep *ep)
>>   					dep->name))
>>   		return 0;
>>   
>> +	cancel_delayed_work_sync(&dep->nostream_work);
>> +
> 
> We may not sleep during dwc3_gadget_ep_disable() and we shouldn't call
> *_sync() here.
> 
>>   	spin_lock_irqsave(&dwc->lock, flags);
>>   	ret = __dwc3_gadget_ep_disable(dep);
>>   	spin_unlock_irqrestore(&dwc->lock, flags);
>> @@ -3508,6 +3510,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
>>   		}
>>   
>>   		dwc3_debugfs_remove_endpoint_dir(dep);
>> +		cancel_delayed_work_sync(&dep->nostream_work);
> 
> Just this here is sufficient.
> 
>>   		kfree(dep);
>>   	}
>>   }
>>
>> base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727
>> -- 
>> 2.44.4
>>
> 
> Pei Xiao already submitted a patch for this:
> https://lore.kernel.org/linux-usb/331d1d5133496d2b4184e05f8848adb06930a138.1785893865.git.xiaopei01@kylinos.cn/T/#u
> 
Thanks for the review , good to see this issue is already covered by
Pei Xiao's patch
-Radhey