Re: [PATCH v3 2/2] usb: gadget: goku_udc: fix kobject warning on probe failure

[Cheng Lingfei]

On 8/26/2026 5:27 PM, Greg Kroah-Hartman wrote:
> On Wed, Aug 26, 2026 at 05:15:07PM +0800, Cheng Lingfei wrote:
> > goku_probe() calls goku_remove() when hardware initialization fails, but
> > the gadget device is initialized only near the end of probe. As a result,
> > goku_remove() calls usb_del_gadget_udc(), which drops a reference to an
> > uninitialized gadget device and triggers a kobject warning.
> >
> > Initialize the gadget device immediately after allocating the controller,
> > but add it only after all hardware resources have been acquired. Track the
> > gadget registration state so goku_remove() can safely clean up both partial
> > probe state and a fully initialized device.
> >
> > Use the split gadget removal API and drop the final gadget reference only
> > after all hardware resources have been released. Obtain the controller from
> > the embedded gadget device in the release callback because driver data is
> > set on the PCI device rather than the gadget device.
> >
> > Fixes: 3301c215a2bb ("USB: UDC: Expand device model API interface")
> > Reported-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=06ec7624018233e17113
> > Tested-by: syzbot+06ec7624018233e17113@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Assisted-by: Codex:gpt-5.6
> > Signed-off-by: Cheng Lingfei <chenglingfei@xxxxxxxxxxx>
> > ---
> >   drivers/usb/gadget/udc/goku_udc.c | 28 ++++++++++++++--------------
> >   drivers/usb/gadget/udc/goku_udc.h |  3 ++-
> >   2 files changed, 16 insertions(+), 15 deletions(-)
> >
> > diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
> > index 5ad8633f522b..615cc6b8f354 100644
> > --- a/drivers/usb/gadget/udc/goku_udc.c
> > +++ b/drivers/usb/gadget/udc/goku_udc.c
> > @@ -20,6 +20,7 @@
> >   // #define	VERBOSE		/* extra debug messages (success too) */
> >   // #define	USB_TRACE	/* packet-level success messages */
> >   
> > +#include <linux/container_of.h>
> >   #include <linux/debugfs.h>
> >   #include <linux/kernel.h>
> >   #include <linux/module.h>
> > @@ -1726,7 +1727,7 @@ static irqreturn_t goku_irq(int irq, void *_dev)
> >   
> >   static void gadget_release(struct device *_dev)
> >   {
> > -	struct goku_udc	*dev = dev_get_drvdata(_dev);
> > +	struct goku_udc *dev = container_of(_dev, struct goku_udc, gadget.dev);
>
> That looks wrong.  If it is correct, please create a proper macro for it
> so that you verify that this all is working properly.

The object allocated by goku_probe() is struct goku_udc, with struct 
usb_gadget embedded in it. Therefore, when the gadget release callback 
is invoked with a pointer to the embedded gadget.dev, it must recover 
and free the enclosing struct goku_udc.
This follows the same pattern used by the net2280 and fsl_qe_udc 
drivers. I agree that the conversion should be made explicit, so I will 
add a helper macro in the next revision:

#define to_goku_udc(g) \
	container_of((g), struct goku_udc, gadget)

#define gadget_dev_to_goku_udc(d) \
	to_goku_udc(dev_to_usb_gadget(d))

--
Best regards,
Cheng Lingfei