[PATCH] usb: dwc3: fix use of destroyed dwc->connect_mutex on gadget exit

[Marek Szyprowski]

dwc3_gadget_exit() destroys dwc->connect_mutex before calling
usb_del_gadget(), which unbinds the gadget driver and ends up in
dwc3_gadget_pullup() taking that already destroyed mutex. With
CONFIG_DEBUG_MUTEXES this triggers the following warning on reboot:

 DEBUG_LOCKS_WARN_ON(lock->magic != lock)
 WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x4bc/0xb88, CPU#1: systemd-shutdow/1
 ...
 Call trace:
  __mutex_lock+0x4bc/0xb88 (P)
  mutex_lock_nested+0x24/0x30
  dwc3_gadget_pullup+0x88/0x150
  usb_gadget_disconnect_locked+0x44/0x1f0
  gadget_unbind_driver+0x48/0x124
  device_remove+0x4c/0x80
  device_release_driver_internal+0x1e0/0x23c
  device_release_driver+0x18/0x24
  bus_remove_device+0xe8/0x1a0
  device_del+0x14c/0x414
  usb_del_gadget+0x90/0xe8
  dwc3_gadget_exit+0x40/0x9c
  dwc3_drd_exit+0xe4/0x14c
  dwc3_core_remove+0x140/0x17c
  dwc3_qcom_remove+0x38/0x120
  platform_shutdown+0x24/0x34
  device_shutdown+0x158/0x260
  kernel_restart+0x44/0xa4
  __do_sys_reboot+0x118/0x24c
  ...

Fix this by initializing dwc->connect_mutex together with dwc->mutex in
dwc3_core_probe().

Fixes: 1ff77cbefe5a ("usb: dwc3: gadget: fix IRQ storm on invalid event buffer count")
Assisted-by: Claude Opus 5.5 <noreply@xxxxxxxxxxxxx>
Signed-off-by: Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>
---
 drivers/usb/dwc3/core.c   | 1 +
 drivers/usb/dwc3/gadget.c | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index fd5c2cd36c59..f977bc3eeb79 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -2373,6 +2373,7 @@ int dwc3_core_probe(const struct dwc3_probe_data *data)
 	}
 
 	mutex_init(&dwc->mutex);
+	mutex_init(&dwc->connect_mutex);
 
 	pm_runtime_get_noresume(dev);
 	pm_runtime_set_active(dev);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index ee837235630a..8fd1fd9b0db3 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -4879,7 +4879,6 @@ int dwc3_gadget_init(struct dwc3 *dwc)
 
 	init_completion(&dwc->ep0_in_setup);
 	INIT_WORK(&dwc->err_recovery_work, dwc3_err_recovery_work);
-	mutex_init(&dwc->connect_mutex);
 	dwc->gadget = kzalloc_obj(struct usb_gadget);
 	if (!dwc->gadget) {
 		ret = -ENOMEM;
@@ -4977,7 +4976,6 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 		return;
 
 	cancel_work_sync(&dwc->err_recovery_work);
-	mutex_destroy(&dwc->connect_mutex);
 	dwc3_enable_susphy(dwc, true);
 	usb_del_gadget(dwc->gadget);
 	dwc3_gadget_free_endpoints(dwc);
-- 
2.43.0