Re: [PATCH v5] usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

[Thinh Nguyen]

On Tue, Sep 15, 2026, Jiazi Liu wrote:
> When dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the
> event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check
> that event count does not exceed event buffer length") returns IRQ_NONE
> without writing back GEVNTCOUNT. Since the DWC3 interrupt is
> level-triggered, the uncleared IRQ source keeps the line asserted,
> causing a tight IRQ storm that accumulates 99,900 unhandled interrupts
> and triggers spurious.c:184 BUG -> kernel panic.
> 
> The resulting call stack:
>   __report_bad_irq+0xac/0xc8
>   note_interrupt+0x340/0x468
>   handle_irq_event+0xac/0xc0
>   handle_fasteoi_irq+0x120/0x228
>   gic_handle_irq+0x68/0x108
>   ...
>   kernel BUG at kernel/irq/spurious.c:184
> 
> To reproduce, write a bogus value exceeding the event buffer length
> directly to the GEVNTCOUNT register:
> 
>   devmem <DWC3_BASE + 0xc40c> 4 0x1004
> 
> Write the bogus count back to GEVNTCOUNT to clear the IRQ source,
> consistent with the stale event clearing pattern in
> dwc3_event_buffers_setup(), and schedule error recovery to
> reinitialize the controller.
> 
> Fixes: 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
> Signed-off-by: Jiazi Liu <jiazi.liu1984@xxxxxxxxx>
> ---
>  drivers/usb/dwc3/core.h   |  19 +++++++
>  drivers/usb/dwc3/ep0.c    |   9 ++++
>  drivers/usb/dwc3/gadget.c | 108 +++++++++++++++++++++++++++++++++++++-
>  3 files changed, 134 insertions(+), 2 deletions(-)
> 

Acked-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>

Thanks,
Thinh