[PATCH] usb: cdns3: gadget: fix resource leak on gadget init failure

[PATCH] usb: cdns3: gadget: fix resource leak on gadget init failure

[Yongchao Wu]

When cdns3_gadget_start() fails, the DRD gadget is left in an
initialized state, causing a resource leak. When switching to host
mode, the stale state triggers a synchronous external abort in
xhci_gen_setup(), leading to kernel panic:

[  1301.377716][ T5000][E] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
[  1301.382485][ T5000][I] pc : xhci_gen_setup+0xa4/0x408
[  1301.393391][ T5000][I] backtrace:
    ...
    xhci_gen_setup+0xa4/0x408    <-- CRASH
    xhci_plat_setup+0x44/0x58
    usb_add_hcd+0x284/0x678
    ...
    cdns_role_set+0x9c/0xbc        <-- Role switch

Fix by calling cdns_drd_gadget_off() in the error path to properly
clean up the DRD gadget state. This prevents both the resource leak
and the kernel panic during role switching.

Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
---
 drivers/usb/cdns3/cdns3-gadget.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index d59a60a16..4cc3f2ffb 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -3428,6 +3428,7 @@ static int __cdns3_gadget_init(struct cdns *cdns)
 	ret = cdns3_gadget_start(cdns);
 	if (ret) {
 		pm_runtime_put_sync(cdns->dev);
+		cdns_drd_gadget_off(cdns);
 		return ret;
 	}
 
-- 
2.43.0

Re: [PATCH] usb: cdns3: gadget: fix resource leak on gadget init failure

[Peter Chen (CIX)]

On 26-03-28 23:15:50, Yongchao Wu wrote:
> When cdns3_gadget_start() fails, the DRD gadget is left in an
> initialized state, causing a resource leak. When switching to host
> mode, the stale state triggers a synchronous external abort in
> xhci_gen_setup(), leading to kernel panic:
> 
> [  1301.377716][ T5000][E] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
> [  1301.382485][ T5000][I] pc : xhci_gen_setup+0xa4/0x408
> [  1301.393391][ T5000][I] backtrace:
>     ...
>     xhci_gen_setup+0xa4/0x408    <-- CRASH
>     xhci_plat_setup+0x44/0x58
>     usb_add_hcd+0x284/0x678
>     ...
>     cdns_role_set+0x9c/0xbc        <-- Role switch
> 
> Fix by calling cdns_drd_gadget_off() in the error path to properly
> clean up the DRD gadget state. This prevents both the resource leak
> and the kernel panic during role switching.
> 

Good catch.

I have two questions:
- What exactly resource is leaked?
- Do you call cdns_drd_host_on before setup host?

Besides, you may add Fixed-by tag and Cc to stable tree.

Peter

> Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
> ---
>  drivers/usb/cdns3/cdns3-gadget.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index d59a60a16..4cc3f2ffb 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -3428,6 +3428,7 @@ static int __cdns3_gadget_init(struct cdns *cdns)
>  	ret = cdns3_gadget_start(cdns);
>  	if (ret) {
>  		pm_runtime_put_sync(cdns->dev);
> +		cdns_drd_gadget_off(cdns);
>  		return ret;
>  	}
>  
> -- 
> 2.43.0
> 
> 

-- 

Best regards,
Peter

Re: [PATCH] usb: cdns3: gadget: fix resource leak on gadget init failure

[吴永超]

On 26-03-30, Peter Chen wrote:
> I have two questions:
> - What exactly resource is leaked?
> - Do you call cdns_drd_host_on before setup host?

For the first question:
The DRD hardware is left in gadget mode while software state remains
INACTIVE, creating hardware/software state inconsistency.
I will update the commit title to "usb: cdns3: gadget: fix state
inconsistency on gadget init failure" to better reflect this.

For the second question:
When gadget start fails, the role state is not set to
CDNS_ROLE_STATE_ACTIVE. When switching to host via:
  echo host > /sys/class/usb_role/13180000.usb-role-switch/role

The flow is:
  cdns_role_set()
    -> cdns_role_stop()
         if (cdns->roles[role]->state == CDNS_ROLE_STATE_INACTIVE)
             return;  // Skips cleanup because state is still INACTIVE

This violates the DRD controller design specification (Figure22),
which requires returning to idle state before switching roles.

Error logs:
[  516.440698][ T4992] configfs-gadget 13180000.usb: failed to start g1: -19
[  516.442035][ T4992] cdns-usb3 13180000.usb: Failed to add gadget
[  516.443278][ T4992] cdns-usb3 13180000.usb: set role 2 has failed
...
echo host > /sys/class/usb_role/13180000.usb-role-switch/role
[ 1301.375722][ T5000] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[ 1301.377716][ T5000] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
...

I will prepare v2 with Fixed-by tag and Cc to stable tree.

-----邮件原件-----
发件人: Peter Chen (CIX) <peter.chen@kernel.org> 
发送时间: 2026年3月30日 13:52
收件人: Yongchao Wu <yongchao.wu@autochips.com>
抄送: Pawel Laszczak <pawell@cadence.com>; Roger Quadros <rogerq@kernel.org>; Greg Kroah-Hartman <gregkh@linuxfoundation.org>; linux-usb@vger.kernel.org; linux-kernel@vger.kernel.org
主题: Re: [PATCH] usb: cdns3: gadget: fix resource leak on gadget init failure

On 26-03-28 23:15:50, Yongchao Wu wrote:
> When cdns3_gadget_start() fails, the DRD gadget is left in an 
> initialized state, causing a resource leak. When switching to host 
> mode, the stale state triggers a synchronous external abort in 
> xhci_gen_setup(), leading to kernel panic:
> 
> [  1301.377716][ T5000][E] Internal error: synchronous external abort: 
> 96000010 [#1] PREEMPT SMP [  1301.382485][ T5000][I] pc : 
> xhci_gen_setup+0xa4/0x408 [  1301.393391][ T5000][I] backtrace:
>     ...
>     xhci_gen_setup+0xa4/0x408    <-- CRASH
>     xhci_plat_setup+0x44/0x58
>     usb_add_hcd+0x284/0x678
>     ...
>     cdns_role_set+0x9c/0xbc        <-- Role switch
> 
> Fix by calling cdns_drd_gadget_off() in the error path to properly 
> clean up the DRD gadget state. This prevents both the resource leak 
> and the kernel panic during role switching.
> 

Good catch.

I have two questions:
- What exactly resource is leaked?
- Do you call cdns_drd_host_on before setup host?

Besides, you may add Fixed-by tag and Cc to stable tree.

Peter

> Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
> ---
>  drivers/usb/cdns3/cdns3-gadget.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c 
> b/drivers/usb/cdns3/cdns3-gadget.c
> index d59a60a16..4cc3f2ffb 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -3428,6 +3428,7 @@ static int __cdns3_gadget_init(struct cdns *cdns)
>  	ret = cdns3_gadget_start(cdns);
>  	if (ret) {
>  		pm_runtime_put_sync(cdns->dev);
> +		cdns_drd_gadget_off(cdns);
>  		return ret;
>  	}
>  
> --
> 2.43.0
> 
> 

-- 

Best regards,
Peter