Re: [PATCH] usb: gadget: goku_udc: fix kobject warning on probe failure

[Greg Kroah-Hartman]

On Wed, Aug 26, 2026 at 03:00:37PM +0800, Cheng Lingfei wrote:
> On 8/26/2026 2:11 PM, Greg Kroah-Hartman wrote:
> > On Wed, Aug 26, 2026 at 11:35:58AM +0800, Cheng Lingfei wrote:
> > > goku_probe() calls goku_remove() when hardware initialization fails, but
> > > the gadget device is initialized only near the end of probe. As a result,
> > > goku_remove() calls usb_del_gadget_udc(), which drops a reference to an
> > > uninitialized gadget device and triggers a kobject warning.
> > > 
> > > Initialize the gadget device immediately after allocating the controller,
> > > but add it only after all hardware resources have been acquired. Track the
> > > gadget and proc entry registration state so goku_remove() can safely clean
> > > up both partial probe state and a fully initialized device.
> > > 
> > > Use the split gadget removal API and drop the final gadget reference only
> > > after all hardware resources have been released.
> > > 
> > > Also obtain the controller from the embedded gadget device in the release
> > > callback. Driver data is set on the PCI device rather than the gadget
> > > device, so using dev_get_drvdata() there fails to free the controller.
> > > 
> > > Use a per-device name for the debug proc entry so that multiple
> > > controllers can be registered without colliding on /proc/driver/udc.
> > > 
> > > Fixes: 3301c215a2bb ("USB: UDC: Expand device model API interface")
> > > Reported-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > Closes: https://syzkaller.appspot.com/bug?extid=06ec7624018233e17113
> > > Tested-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > 
> > > Signed-off-by: Cheng Lingfei <chenglingfei@xxxxxxxxxxx>
> > 
> > No Assisted-by: line?
> > 
> > And do you see this happening in a real device and not just a fake one?
> > 
> > And why is this driver using proc at all, shouldn't that be in debugfs
> > instead?
> > 
> > thanks,
> > 
> > greg k-h
> 
> Thanks for the review.
> 
> I do not have TC86C001 hardware. The issue was reproduced only by
> syzbot, whose reproducer binds goku_udc to unrelated QEMU PCI devices
> through the PCI new_id interface.

Which is an invalid operation, you don't have to worry about that ever
happening in a real world situation.  syzbot is wrong here.

> The probe cleanup path itself can also be reached on real hardware if
> one of the probe steps fails, but I cannot claim that the issue has
> been reproduced on real hardware.
> 
> The proc entry is legacy diagnostic code from this old driver, so I
> agree that debugfs is the appropriate interface. I will rework the
> patch accordingly and send a v2.
> 
> I will also add the missing Assisted-by line.

thanks!

greg k-h