usb: gadget: pch_udc: don't call pch_udc_remove() from the probe error path

From: Vasileios Almpanis

Date: Tue Aug 11 2026 - 11:12:17 EST


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git d58772d8520c7ef247c4b95c9bd76d3a25da9ff5

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 0a6886428739..5704aff2b09b 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -2979,16 +2979,8 @@ static void pch_udc_shutdown(struct pci_dev *pdev)
pch_udc_set_disconnect(dev);
}

-static void pch_udc_remove(struct pci_dev *pdev)
+static void pch_udc_cleanup(struct pch_udc_dev *dev)
{
- struct pch_udc_dev *dev = pci_get_drvdata(pdev);
-
- usb_del_gadget_udc(&dev->gadget);
-
- /* gadget driver must not be registered */
- if (dev->driver)
- dev_err(&pdev->dev,
- "%s: gadget driver still bound!!!\n", __func__);
/* dma pool cleanup */
dma_pool_destroy(dev->data_requests);

@@ -3016,6 +3008,20 @@ static void pch_udc_remove(struct pci_dev *pdev)
pch_udc_exit(dev);
}

+static void pch_udc_remove(struct pci_dev *pdev)
+{
+ struct pch_udc_dev *dev = pci_get_drvdata(pdev);
+
+ usb_del_gadget_udc(&dev->gadget);
+
+ /* gadget driver must not be registered */
+ if (dev->driver)
+ dev_err(&pdev->dev,
+ "%s: gadget driver still bound!!!\n", __func__);
+
+ pch_udc_cleanup(dev);
+}
+
static int __maybe_unused pch_udc_suspend(struct device *d)
{
struct pch_udc_dev *dev = dev_get_drvdata(d);
@@ -3106,7 +3112,7 @@ static int pch_udc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
return 0;

finished:
- pch_udc_remove(pdev);
+ pch_udc_cleanup(dev);
return retval;
}