Re: [PATCH] drivers: firmware_loader: fix race between sysfs fallback cleanup and device removal

[Greg KH]

On Tue, Apr 21, 2026 at 09:49:57PM +0800, l1za0.sec@xxxxxxxxx wrote:
> From: Haocheng Yu <l1za0.sec@xxxxxxxxx>
> 
> A WARNING in firmware_fallback_sysfs is reported by a modified
> Syzkaller-based kernel fuzzing tool that we developed.
> 
> The cause of this issue is a possible race condition between
> firmware sysfs fallback cleanup and hot-plug or other device
> lifecycle paths.

How exactly?  This device is under full control of this function, it
should "know" if it is registered or not.  No other code path should be
ever unregistering it.

> In this case, fw_load_sysfs_fallback() might run cleanup after the
> fallback device has already been removed, i.e., it would execute
> device_del(), then dpm_sysfs_remove(), and finally trigger a
> warning in sysfs_remove_group().

How exactly does that happen?

> This problem can be avoided by adding device_is_registered()
> check before calling device_del().
> 
> Signed-off-by: Haocheng Yu <l1za0.sec@xxxxxxxxx>

Do you have a reproducer for this issue?


> ---
>  drivers/base/firmware_loader/fallback.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
> index bf68e3947814..a8d8c494f82d 100644
> --- a/drivers/base/firmware_loader/fallback.c
> +++ b/drivers/base/firmware_loader/fallback.c
> @@ -116,8 +116,9 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout)
>  	} else if (fw_priv->is_paged_buf && !fw_priv->data)
>  		retval = -ENOMEM;
>  
> -out:
> -	device_del(f_dev);
> +out:
> +	if (device_is_registered(f_dev))
> +		device_del(f_dev);

Again, this feels wrong.  And why was the "out:" line added and added
back?  That feels like something is odd with the diff?

thanks,

greg k-h