Re: [PATCH] usb: gadget: goku_udc: fix kobject warning on probe failure

[Cheng Lingfei]

On 8/26/2026 2:11 PM, Greg Kroah-Hartman wrote:
> On Wed, Aug 26, 2026 at 11:35:58AM +0800, Cheng Lingfei wrote:
> > goku_probe() calls goku_remove() when hardware initialization fails, but
> > the gadget device is initialized only near the end of probe. As a result,
> > goku_remove() calls usb_del_gadget_udc(), which drops a reference to an
> > uninitialized gadget device and triggers a kobject warning.
> >
> > Initialize the gadget device immediately after allocating the controller,
> > but add it only after all hardware resources have been acquired. Track the
> > gadget and proc entry registration state so goku_remove() can safely clean
> > up both partial probe state and a fully initialized device.
> >
> > Use the split gadget removal API and drop the final gadget reference only
> > after all hardware resources have been released.
> >
> > Also obtain the controller from the embedded gadget device in the release
> > callback. Driver data is set on the PCI device rather than the gadget
> > device, so using dev_get_drvdata() there fails to free the controller.
> >
> > Use a per-device name for the debug proc entry so that multiple
> > controllers can be registered without colliding on /proc/driver/udc.
> >
> > Fixes: 3301c215a2bb ("USB: UDC: Expand device model API interface")
> > Reported-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=06ec7624018233e17113
> > Tested-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> >
> > Signed-off-by: Cheng Lingfei <chenglingfei@xxxxxxxxxxx>
>
> No Assisted-by: line?
>
> And do you see this happening in a real device and not just a fake one?
>
> And why is this driver using proc at all, shouldn't that be in debugfs
> instead?
>
> thanks,
>
> greg k-h

Thanks for the review.

I do not have TC86C001 hardware. The issue was reproduced only by
syzbot, whose reproducer binds goku_udc to unrelated QEMU PCI devices
through the PCI new_id interface.

The probe cleanup path itself can also be reached on real hardware if
one of the probe steps fails, but I cannot claim that the issue has
been reproduced on real hardware.

The proc entry is legacy diagnostic code from this old driver, so I
agree that debugfs is the appropriate interface. I will rework the
patch accordingly and send a v2.

I will also add the missing Assisted-by line.