Re: [PATCH 2/5] usb: dwc2: fix a possible interrupt storm on stm32mp1

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] usb: dwc2: NULL dereference of hcd in peripheral-only mode
- [High] usb: dwc2: incomplete fix for interrupt storm during resume from PPD/Hibernation
--

commit b421af8a6c891894bff06680a711320a770d78db
Author: Fabrice Gasnier <fabrice.gasnier@foss.st.com>

usb: dwc2: fix a possible interrupt storm on stm32mp1

This commit addresses an interrupt storm on stm32mp1 seen during system resume
from low power mode when in host mode. It sets the HCD_FLAG_HW_ACCESSIBLE flag
in dwc2_handle_wakeup_detected_intr() after exiting clock gating, allowing
the controller to successfully process interrupts.

Cc: stable@vger.kernel.org

> diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
> index 9565e6a52725a..8f83c36d002da 100644
> --- a/drivers/usb/dwc2/core_intr.c
> +++ b/drivers/usb/dwc2/core_intr.c
> @@ -453,6 +453,8 @@ static void dwc2_handle_wakeup_detected_intr(struct dwc2_hsotg *hsotg)
>  		}
>  	} else {
>  		if (hsotg->lx_state == DWC2_L2) {
> +			struct usb_hcd *hcd = hsotg->priv;
> +
>  			if (hsotg->in_ppd) {
>  				ret = dwc2_exit_partial_power_down(hsotg, 1,
>  								   true);
> @@ -463,8 +465,10 @@ static void dwc2_handle_wakeup_detected_intr(struct dwc2_hsotg *hsotg)
>  
>  			if (hsotg->params.power_down ==
>  			    DWC2_POWER_DOWN_PARAM_NONE && hsotg->bus_suspended &&
> -			    !hsotg->params.no_clock_gating)
> +			    !hsotg->params.no_clock_gating) {
>  				dwc2_host_exit_clock_gating(hsotg, 1);
> +				set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
> +			}

[Severity: High]
Is the interrupt storm fix incomplete because the HCD_FLAG_HW_ACCESSIBLE
restoration is restricted to the clock gating case?

If the platform uses Partial Power Down (DWC2_POWER_DOWN_PARAM_PARTIAL) or
Hibernation (DWC2_POWER_DOWN_PARAM_HIBERNATION), _dwc2_hcd_suspend() also
clears the HCD_FLAG_HW_ACCESSIBLE flag.

When the system wakes up in those modes, dwc2_handle_wakeup_detected_intr()
executes the partial power down exit paths (such as the call to
dwc2_exit_partial_power_down() just above this block) but never restores the
HCD_FLAG_HW_ACCESSIBLE flag since this restoration is placed inside the
DWC2_POWER_DOWN_PARAM_NONE condition.

Will the same interrupt storm bug persist for platforms using PPD or
Hibernation?

[Severity: High]
Can this unconditionally dereference hcd and cause a kernel panic in a
peripheral-only configuration?

If the system is built with CONFIG_USB_DWC2_PERIPHERAL=y or constrained to
peripheral mode (dr_mode == USB_DR_MODE_PERIPHERAL), dwc2_hcd_init() is
skipped, meaning hsotg->priv (and thus hcd) remains NULL.

If the hardware is suspended (hsotg->lx_state == DWC2_L2), and an OTG cable
insertion or hardware transient autonomously switches the controller's CURMODE
bit to Host mode, dwc2_is_device_mode() will return false.

Execution will then enter this host branch in
dwc2_handle_wakeup_detected_intr(), leading to a NULL pointer dereference
when it tries to update hcd->flags.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008-dwc2-low-power-fixes-stm32-v1-0-5b303df762e6@foss.st.com?part=2