Re: [PATCH v3 2/2] usb: gadget: goku_udc: fix kobject warning on probe failure

[Greg Kroah-Hartman]

On Wed, Aug 26, 2026 at 05:15:07PM +0800, Cheng Lingfei wrote:
> goku_probe() calls goku_remove() when hardware initialization fails, but
> the gadget device is initialized only near the end of probe. As a result,
> goku_remove() calls usb_del_gadget_udc(), which drops a reference to an
> uninitialized gadget device and triggers a kobject warning.
> 
> Initialize the gadget device immediately after allocating the controller,
> but add it only after all hardware resources have been acquired. Track the
> gadget registration state so goku_remove() can safely clean up both partial
> probe state and a fully initialized device.
> 
> Use the split gadget removal API and drop the final gadget reference only
> after all hardware resources have been released. Obtain the controller from
> the embedded gadget device in the release callback because driver data is
> set on the PCI device rather than the gadget device.
> 
> Fixes: 3301c215a2bb ("USB: UDC: Expand device model API interface")
> Reported-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=06ec7624018233e17113
> Tested-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Cheng Lingfei <chenglingfei@xxxxxxxxxxx>
> ---
>  drivers/usb/gadget/udc/goku_udc.c | 28 ++++++++++++++--------------
>  drivers/usb/gadget/udc/goku_udc.h |  3 ++-
>  2 files changed, 16 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
> index 5ad8633f522b..615cc6b8f354 100644
> --- a/drivers/usb/gadget/udc/goku_udc.c
> +++ b/drivers/usb/gadget/udc/goku_udc.c
> @@ -20,6 +20,7 @@
>  // #define	VERBOSE		/* extra debug messages (success too) */
>  // #define	USB_TRACE	/* packet-level success messages */
>  
> +#include <linux/container_of.h>
>  #include <linux/debugfs.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
> @@ -1726,7 +1727,7 @@ static irqreturn_t goku_irq(int irq, void *_dev)
>  
>  static void gadget_release(struct device *_dev)
>  {
> -	struct goku_udc	*dev = dev_get_drvdata(_dev);
> +	struct goku_udc *dev = container_of(_dev, struct goku_udc, gadget.dev);

That looks wrong.  If it is correct, please create a proper macro for it
so that you verify that this all is working properly.