From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f200.google.com (mail-oi1-f200.google.com [209.85.167.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E64038F938 for ; Wed, 26 Aug 2026 08:03:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.200 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787731404; cv=none; b=DmdtCCZJuJfUoeeC6LrLhpkYCUtbhf94oKqMce7dnw0yjMha9DHVki9oko2czyUNVn12OgZT5Lq8miPettUcP7UoXttRULOK3oR6fxYSpQEmvuPJv8F33+0QPuBlnb7+z+eYbb0U+kqBkKXWYgZKn4+MTHxB4K0dLLlRBQ92t9k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787731404; c=relaxed/simple; bh=q3f7WE5rFwtLI5jW5YQEjDYAQ2o0VJ4a2txZ4evlp0I=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=czaQjTR6MsWtRAYYUN7gXVTLQQsLKl/Q0T1JYM/Hphf5q7BZ73X043Vtls2zfBkkvafibeWgwi/2frKCMtIcG1vxqBqo1rN46FzWF0LG1WTbwi+fJe/R8vl7QPA1MaRAysCJlAMQdMWnstNJ8ozBrIeOFWFdZITTl/8NLBAohzI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f200.google.com with SMTP id 5614622812f47-4ab4ca7ce3fso1260831b6e.0 for ; Wed, 26 Aug 2026 01:03:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787731402; x=1788336202; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=bU5eK/3eWbajtY+58W4hnNE0lCdy93sAvVdHW4ItgW4=; b=eALkjuHiTjWOQUVtK/L6DGJEAGC8bq8fE/ILstUH5K0nIMerDJKGKunvLj+Bt4gr7j DMNQKmRwM8AEfkdyEMLYgHqHX3Gj8E6v9oj15B7TM54xNc7hxG4371cm0iGPTFV1lk3c TVNZ4InD2tOgMjdpIY2Esxfcb9LJ5rTYuzmjAkRWau4Flg15yLDgmJXc7GeBS23MoQF1 2btQUeL2Txvhg1+fgECKyN8q76wz2QUO4vFcjYadz+XHFcO/iiyepp+i1foxEXnYzbX8 sTo/Sssfwkzbj5dE2JTV7Vjpw8F1w/UUG7w/dAmc01LbUvH2YoLqH1eCA0OFR72BDy5g JxWQ== X-Gm-Message-State: AFuF++km3+1OwZ6zGkcAwUZAd5Z/CFJp9dMFULE5zehrQjOxORQg4JL3 TKZn74MhOrNgWbX4Te+CykV3peIzeHG8LXj4MwfZj65+U+T4552FL29xMtC1lVSwS7ERnG7b3VY WmFfrACkdC+fMR272W4sm8OgTiTA+0fQjrnAz/oOsgkuap2QcRipvNOl2LtI= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:1451:b0:4ab:2c58:4514 with SMTP id 5614622812f47-4b36648ae61mr5635917b6e.0.1787731402060; Wed, 26 Aug 2026 01:03:22 -0700 (PDT) Date: Wed, 26 Aug 2026 01:03:22 -0700 In-Reply-To: <6a7e2ce8.f70deec7.2acc03.000c.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a8e9dca.a5a502ce.31d34.014c.GAE@google.com> Subject: Forwarded: Re: [syzbot] [kernel?] WARNING: kobject bug in goku_remove From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Re: [syzbot] [kernel?] WARNING: kobject bug in goku_remove Author: chenglingfei@foxmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c index ac2a984c2f87..e6941b9d0f6b 100644 --- a/drivers/usb/gadget/udc/goku_udc.c +++ b/drivers/usb/gadget/udc/goku_udc.c @@ -20,6 +20,8 @@ // #define VERBOSE /* extra debug messages (success too) */ // #define USB_TRACE /* packet-level success messages */ +#include +#include #include #include #include @@ -30,9 +32,9 @@ #include #include #include -#include #include #include +#include #include #include #include @@ -1050,9 +1052,7 @@ static inline const char *dmastr(void) return "(dma IN)"; } -#ifdef CONFIG_USB_GADGET_DEBUG_FILES - -static const char proc_node_name [] = "driver/udc"; +#ifdef CONFIG_USB_GADGET_DEBUG_FS #define FOURBITS "%s%s%s%s" #define EIGHTBITS FOURBITS FOURBITS @@ -1134,7 +1134,7 @@ static const char *udc_ep_status(u32 status) return "?"; } -static int udc_proc_read(struct seq_file *m, void *v) +static int goku_debugfs_show(struct seq_file *m, void *v) { struct goku_udc *dev = m->private; struct goku_udc_regs __iomem *regs = dev->regs; @@ -1246,7 +1246,33 @@ static int udc_proc_read(struct seq_file *m, void *v) local_irq_restore(flags); return 0; } -#endif /* CONFIG_USB_GADGET_DEBUG_FILES */ +DEFINE_SHOW_ATTRIBUTE(goku_debugfs); + +static void goku_debugfs_create(struct goku_udc *dev) +{ + dev->debugfs_root = + debugfs_create_dir(dev_name(&dev->pdev->dev), usb_debug_root); + debugfs_create_file("goku_udc_state", 0400, dev->debugfs_root, dev, + &goku_debugfs_fops); +} + +static void goku_debugfs_remove(struct goku_udc *dev) +{ + debugfs_remove_recursive(dev->debugfs_root); + dev->debugfs_root = NULL; +} + +#else + +static inline void goku_debugfs_create(struct goku_udc *dev) +{ +} + +static inline void goku_debugfs_remove(struct goku_udc *dev) +{ +} + +#endif /* CONFIG_USB_GADGET_DEBUG_FS */ /*-------------------------------------------------------------------------*/ @@ -1701,7 +1727,7 @@ static irqreturn_t goku_irq(int irq, void *_dev) static void gadget_release(struct device *_dev) { - struct goku_udc *dev = dev_get_drvdata(_dev); + struct goku_udc *dev = container_of(_dev, struct goku_udc, gadget.dev); kfree(dev); } @@ -1714,13 +1740,12 @@ static void goku_remove(struct pci_dev *pdev) DBG(dev, "%s\n", __func__); - usb_del_gadget_udc(&dev->gadget); + if (dev->added) + usb_del_gadget(&dev->gadget); BUG_ON(dev->driver); -#ifdef CONFIG_USB_GADGET_DEBUG_FILES - remove_proc_entry(proc_node_name, NULL); -#endif + goku_debugfs_remove(dev); if (dev->regs) udc_reset(dev); if (dev->got_irq) @@ -1736,6 +1761,8 @@ static void goku_remove(struct pci_dev *pdev) dev->regs = NULL; INFO(dev, "unbind\n"); + + usb_put_gadget(&dev->gadget); } /* wrap this driver around the specified pci device, but @@ -1751,16 +1778,13 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) if (!pdev->irq) { printk(KERN_ERR "Check PCI %s IRQ setup!\n", pci_name(pdev)); - retval = -ENODEV; - goto err; + return -ENODEV; } /* alloc, and start init */ dev = kzalloc_obj(*dev); - if (!dev) { - retval = -ENOMEM; - goto err; - } + if (!dev) + return -ENOMEM; pci_set_drvdata(pdev, dev); spin_lock_init(&dev->lock); @@ -1771,6 +1795,8 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) /* the "gadget" abstracts/virtualizes the controller */ dev->gadget.name = driver_name; + usb_initialize_gadget(&pdev->dev, &dev->gadget, gadget_release); + /* now all the pci goodies ... */ retval = pci_enable_device(pdev); if (retval < 0) { @@ -1814,22 +1840,16 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) pci_set_master(pdev); -#ifdef CONFIG_USB_GADGET_DEBUG_FILES - proc_create_single_data(proc_node_name, 0, NULL, udc_proc_read, dev); -#endif - - retval = usb_add_gadget_udc_release(&pdev->dev, &dev->gadget, - gadget_release); + retval = usb_add_gadget(&dev->gadget); if (retval) goto err; + dev->added = 1; + goku_debugfs_create(dev); return 0; err: - if (dev) - goku_remove (pdev); - /* gadget_release is not registered yet, kfree explicitly */ - kfree(dev); + goku_remove(pdev); return retval; } diff --git a/drivers/usb/gadget/udc/goku_udc.h b/drivers/usb/gadget/udc/goku_udc.h index 70023d401079..ed39e7080536 100644 --- a/drivers/usb/gadget/udc/goku_udc.h +++ b/drivers/usb/gadget/udc/goku_udc.h @@ -247,7 +247,12 @@ struct goku_udc { got_region:1, req_config:1, configured:1, - enabled:1; + enabled:1, + added:1; + +#ifdef CONFIG_USB_GADGET_DEBUG_FS + struct dentry *debugfs_root; +#endif /* pci state used to access those endpoints */ struct pci_dev *pdev; @@ -286,4 +291,3 @@ struct goku_udc { xprintk(dev , KERN_WARNING , fmt , ## args) #define INFO(dev,fmt,args...) \ xprintk(dev , KERN_INFO , fmt , ## args) -