[PATCH] usb: dwc3: host: Mark dwc->xhci as null if xhci probe fails

[PATCH] usb: dwc3: host: Mark dwc->xhci as null if xhci probe fails

[Prashanth K]

Currently dwc->xhci is not cleared when xhci_plat_probe fails,
leading to null pointer dereference in dwc3_qcom_read_usb2_speed.
Mark the xhci pointer as NULL to prevent this.

Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
---
 drivers/usb/dwc3/host.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
index c5674161b2b0..b01cf49454c2 100644
--- a/drivers/usb/dwc3/host.c
+++ b/drivers/usb/dwc3/host.c
@@ -219,6 +219,7 @@ int dwc3_host_init(struct dwc3 *dwc)
 	return 0;
 err:
 	platform_device_put(xhci);
+	dwc->xhci = NULL;
 	return ret;
 }
 EXPORT_SYMBOL_GPL(dwc3_host_init);
-- 
2.34.1

Re: [PATCH] usb: dwc3: host: Mark dwc->xhci as null if xhci probe fails

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] usb: dwc3: NULL pointer offset dereference in dwc3_host_exit() during role switch
--

commit 24753f0ba9a09a8a782231f3b06d19d819bc300c
Author: Prashanth K <prashanth.k@oss.qualcomm.com>

usb: dwc3: host: Mark dwc->xhci as null if xhci probe fails

Currently dwc->xhci is not cleared when xhci_plat_probe fails, leading to a
use-after-free or null pointer dereference later. This commit sets the
pointer to NULL in the error path of dwc3_host_init() to prevent this issue.

> diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
> index c5674161b2b08..b01cf49454c2e 100644
> --- a/drivers/usb/dwc3/host.c
> +++ b/drivers/usb/dwc3/host.c
> @@ -219,6 +219,7 @@ int dwc3_host_init(struct dwc3 *dwc)
>  	return 0;
>  err:
>  	platform_device_put(xhci);
> +	dwc->xhci = NULL;

[Severity: High]
Could this lead to an invalid pointer dereference during subsequent role
switches?

In drivers/usb/dwc3/core.c:__dwc3_set_mode(), the role is updated to host mode
before dwc3_host_init() is called, and is never reverted on failure:

__dwc3_set_mode() {
    ...
    dwc3_set_prtcap(dwc, mode);
    dwc->current_dr_role = mode;
    ...
    ret = dwc3_host_init(dwc);
    ...
}

If dwc3_host_init() fails, the role remains set to host mode, and dwc->xhci
is now explicitly NULL. When the system later attempts to switch roles (e.g.,
back to device mode), __dwc3_set_mode() evaluates dwc->current_dr_role and
invokes dwc3_host_exit(dwc). 

Inside dwc3_host_exit(), if dwc->sys_wakeup is true, it unconditionally
evaluates the address of dev inside xhci:

dwc3_host_exit() {
    ...
    if (dwc->sys_wakeup)
        device_init_wakeup(&dwc->xhci->dev, false);
    ...
}

Because dwc->xhci is NULL, &dwc->xhci->dev evaluates to a small non-zero
offset. This bypasses the !dev check inside device_init_wakeup() and can
cause a fault when attempting to read dev->power.can_wakeup.

>  	return ret;
>  }
>  EXPORT_SYMBOL_GPL(dwc3_host_init);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014105711.1708244-1-prashanth.k@oss.qualcomm.com?part=1

Re: [PATCH] usb: dwc3: host: Mark dwc->xhci as null if xhci probe fails

[Greg Kroah-Hartman]

On Wed, Oct 14, 2026 at 04:27:11PM +0530, Prashanth K wrote:
> Currently dwc->xhci is not cleared when xhci_plat_probe fails,
> leading to null pointer dereference in dwc3_qcom_read_usb2_speed.

Why would that happen?  What causes it and requires it?

> Mark the xhci pointer as NULL to prevent this.
> 
> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>

What commit id does this fix?
How was it tested?

thanks,

greg k-h

Re: [PATCH] usb: dwc3: host: Mark dwc->xhci as null if xhci probe fails

[Prashanth K]

On 10/14/2026 4:47 PM, Greg Kroah-Hartman wrote:
> On Wed, Oct 14, 2026 at 04:27:11PM +0530, Prashanth K wrote:
>> Currently dwc->xhci is not cleared when xhci_plat_probe fails,
>> leading to null pointer dereference in dwc3_qcom_read_usb2_speed.
> 
> Why would that happen?  What causes it and requires it?
> 
>> Mark the xhci pointer as NULL to prevent this.
>>
>> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
> 
> What commit id does this fix?
> How was it tested?
> 
> thanks,
> 
> greg k-h

This might not fix the issue, because it doesn't take the 'err' path,
just realized that platform_device_add() doesn't return error value if
the device probe fails.

The crash happens because xhci_halt failed (not sure what caused it),
thats a functional failure from USB, but later the device crashed while
trying to perform system suspend.

Unable to handle kernel NULL pointer dereference at virtual address
0000000000000058

Call trace:
dwc3_qcom_pm_suspend
dpm_run_callback
device_suspend
dpm_suspend
dpm_suspend_start
suspend_devices_and_enter
pm_suspend

Sorry for the spam,
Prashanth K