Re: [PATCH] usb: gadget: pch_udc: don't call pch_udc_remove() from the probe error path
From: Vasileios Almpanis
Date: Wed Sep 02 2026 - 02:30:42 EST
> Probe error paths go to finished label which calls phc_udc_remove. It in
> turn starts with an unconditional usb_del_gadget_udc(). If probe fails
> before the gadget is added then we put a non-initialized kobject
> (gadget.dev) and a WARN is triggered in kobject_put().
>
> WARNING: lib/kobject.c:734 at kobject_put+0x252/0x640 lib/kobject.c:734
> Call Trace:
> put_device+0x1f/0x30 drivers/base/core.c:3880
> pch_udc_remove+0x47/0x510 drivers/usb/gadget/udc/pch_udc.c:2986
> pch_udc_probe+0xcc6/0x1130 drivers/usb/gadget/udc/pch_udc.c:3109
>
> If usb_add_gadget_udc() in turn fails, it has already dropped the gadget
> reference, so the extra usb_del_gadget_udc() is a double put.
>
> Split the hardware/DMA teardown out into pch_udc_cleanup() and call
> only that from the probe error path.
>
Hi everyone!
A gentle ping on this patch. It's already tested by syzbot so it
should be good to go. Please let me know if there is something
I could do differently.
Kind regards,
--
Vasileios Almpanis <vasilisalmpanis@xxxxxxxxx>