Re: [PATCH] drivers: firmware_loader: fix race between sysfs fallback cleanup and device removal

[Greg KH]

On Wed, Apr 22, 2026 at 07:36:15PM +0800, Li Zao wrote:
> In the report, I saw:
> 
> sysfs group 'power' not found for kobject 'ueagle-atm!eagleI.fw'
> WARNING: CPU: 0 PID: 14408 at fs/sysfs/group.c:282 sysfs_remove_group
> fs/sysfs/group.c:282 [inline]
> WARNING: CPU: 0 PID: 14408 at fs/sysfs/group.c:282
> sysfs_remove_group+0x159/0x1b0 fs/sysfs/group.c:273
> 
> The reproducer mainly runs an infinite loop(), which continuously forks
> and executes execute_one() within loop(). execute_one() constructs
> parameters and calls syz_usb_connect(), causing a large number of
> connect and disconnect calls.

Of a fake USB atm device, right?  ATM USB devices are crazy, if you have
the rights to make/destroy lots of them like this, you are running as
root, and can do worse things :)

Luckily ATM is about to be dropped from the kernel, so all is good...

> According to the call trace, this problem is triggered when
> firmware_fallback_sysfs() calls device_del(). So I suppose the problem
> is likely caused by a large number of connect/disconnect operations
> triggering some kind of race condition, leading to the device being
> unregistered and ultimately causing sysfs_remove_group() to remove
> an object that no longer exists. But to be honest, since I'm not very
> familiar with this code, I can't be 100% sure. Sorry for my lack of rigor.

I'd dig into the ueagle driver and see exactly what it is trying to do
with the firmware loading path there, that's probably the issue here,
not in the firmware core.

thanks,

greg k-h