* usb: gadget: u_serial: fix stale req->dep panic on disconnect/reconnect
[not found] <CGME20260721013831epcas2p18cc80c836585f3b38f718881de13cf92@epcas2p1.samsung.com>
@ 2026-07-21 1:35 ` Daehwan Jung
2026-07-21 5:35 ` Greg Kroah-Hartman
0 siblings, 1 reply; 3+ messages in thread
From: Daehwan Jung @ 2026-07-21 1:35 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: open list:USB SUBSYSTEM, open list, dh10.jung
From: "dh10.jung" <dh10.jung@samsung.com>
When DWC3_EP_DELAY_STOP defers ENDXFER, giveback of -ESHUTDOWN requests
arrives after gserial_disconnect(). These stale requests then accumulate
in read_pool via gs_rx_push(). After gadget exit frees the old endpoint,
req->dep becomes a dangling pointer. On the next gserial_connect(),
gs_start_rx() queues these stale requests onto a new endpoint, triggering:
WARNING: CPU: 0 at drivers/usb/dwc3/gadget.c:1990
request 00000000e6e350a5 belongs to ''
Call trace:
dwc3_gadget_ep_queue+0x158/0x1e8
usb_ep_queue+0x60/0xe8
gs_start_rx+0xa4/0x128
gs_start_io+0x128/0x254
gserial_connect+0xb4/0x14c
acm_set_alt+0xa0/0x114
set_config+0x22c/0x384
composite_setup+0x37c/0xc7c
configfs_composite_setup+0x5c/0x88
dwc3_ep0_interrupt+0x6c8/0xbcc
dwc3_thread_interrupt+0xa0/0x1284
irq_thread_fn+0x48/0xa8
irq_thread+0x150/0x31c
kthread+0x150/0x27c
ret_from_fork+0x10/0x20
Fix by discarding -ESHUTDOWN requests immediately in gs_read_complete()
while ep is still valid, preventing stale reqs from entering read_pool.
Fixes: 937ef73d5075 ("USB: serial gadget: rx path data loss fixes")
Signed-off-by: dh10.jung <dh10.jung@samsung.com>
---
drivers/usb/gadget/function/u_serial.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index cdd1dfc666c4..a8f5b0a6df51 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -459,10 +459,22 @@ static void gs_read_complete(struct usb_ep *ep, struct usb_request *req)
{
struct gs_port *port = ep->driver_data;
- /* Queue all received data until the tty layer is ready for it. */
spin_lock(&port->port_lock);
- list_add_tail(&req->list, &port->read_queue);
- schedule_delayed_work(&port->push, 0);
+ if (req->status == -ESHUTDOWN) {
+ /*
+ * Discard shutdown completions here while ep is still valid.
+ * Returning them to read_pool after gserial_disconnect() has
+ * reset the counters causes stale reqs (with req->dep pointing
+ * to the old ep) to be queued onto a new ep at reconnect time,
+ * triggering a req->dep != dep WARN and kernel panic.
+ */
+ gs_free_req(ep, req);
+ port->read_started--;
+ } else {
+ /* Queue all received data until the tty layer is ready for it. */
+ list_add_tail(&req->list, &port->read_queue);
+ schedule_delayed_work(&port->push, 0);
+ }
spin_unlock(&port->port_lock);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread