CVE-2025-39801

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Remove WARN_ON for device endpoint command timeouts

This commit addresses a rarely observed endpoint command timeout

which causes kernel panic due to warn when 'panic_on_warn' is enabled

and unnecessary call trace prints when 'panic_on_warn' is disabled.

It is seen during fast software-controlled connect/disconnect testcases.

The following is one such endpoint command timeout that we observed:

1. Connect

=======

->dwc3_thread_interrupt

->dwc3_ep0_interrupt

->configfs_composite_setup

->composite_setup

->usb_ep_queue

->dwc3_gadget_ep0_queue

->__dwc3_gadget_ep0_queue

->__dwc3_ep0_do_control_data

->dwc3_send_gadget_ep_cmd

2. Disconnect

==========

->dwc3_thread_interrupt

->dwc3_gadget_disconnect_interrupt

->dwc3_ep0_reset_state

->dwc3_ep0_end_control_data

->dwc3_send_gadget_ep_cmd

In the issue scenario, in Exynos platforms, we observed that control

transfers for the previous connect have not yet been completed and end

transfer command sent as a part of the disconnect sequence and

processing of USB_ENDPOINT_HALT feature request from the host timeout.

This maybe an expected scenario since the controller is processing EP

commands sent as a part of the previous connect. It maybe better to

remove WARN_ON in all places where device endpoint commands are sent to

avoid unnecessary kernel panic due to warn.