[PATCH] usb: dwc3: pci: reject matches without software-node data

[PATCH] usb: dwc3: pci: reject matches without software-node data

[By]

A PCI driver_override bind can reach dwc3_pci_probe() with the dummy ID
from pci_match_device(). Its driver_data is zero, so dwc3_pci_quirks()
passes NULL to device_add_software_node(), which crashes in
software_node_register().

Reject the match before enabling the device or allocating resources.
All static DWC3 PCI IDs provide software-node data.

Build-tested with ARCH=arm64 defconfig and dwc3-pci.o. The runtime
reproducer could not be run in this environment.

Fixes: e492ce9bcaa1 ("usb: dwc3: pci: Register a software node for the dwc3 platform device")
Reported-by: syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=665bae0a102933788e1a
Assisted-by: LLM
Signed-off-by: By <xiaobai050@gmail.com>
---
 drivers/usb/dwc3/dwc3-pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 6c1cbb722..d7fdf6ca6 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -335,6 +335,9 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 	int			ret;
 	struct device		*dev = &pci->dev;
 
+	if (!id->driver_data)
+		return -ENODEV;
+
 	ret = pcim_enable_device(pci);
 	if (ret) {
 		dev_err(dev, "failed to enable pci device\n");
-- 
2.55.0

Re: [PATCH] usb: dwc3: pci: reject matches without software-node data

[Benjamin Marzinski]

These aren't the appropriate people or list to send this patch to.

scripts/get_maintainer.pl is your friend here.

repos/linux$ scripts/get_maintainer.pl 0001-usb-dwc3-pci-reject-matches-without-software-node-da.patch 
Thinh Nguyen <Thinh.Nguyen@synopsys.com> (maintainer:DESIGNWARE USB3 DRD IP DRIVER)
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (maintainer:USB SUBSYSTEM,blamed_fixes:1/1=100%)
Heikki Krogerus <heikki.krogerus@linux.intel.com> (blamed_fixes:1/1=100%)
Felipe Balbi <balbi@kernel.org> (blamed_fixes:1/1=100%)
linux-usb@vger.kernel.org (open list:DESIGNWARE USB3 DRD IP DRIVER)
linux-kernel@vger.kernel.org (open list)
USB SUBSYSTEM status: Supported

So Thinh Nguyen <Thinh.Nguyen@synopsys.com> is the maintainer for this
driver, Greg Kroah-Hartman <gregkh@linuxfoundation.org> is the
maintainer for the subsystem, linux-usb@vger.kernel.org is the mailing
list for this driver, and Heikki Krogerus
<heikki.krogerus@linux.intel.com>, Greg Kroah-Hartman
<gregkh@linuxfoundation.org>, and Felipe Balbi <balbi@kernel.org> all
have something to do with e492ce9bcaa1 ("usb: dwc3: pci: Register a
software node for the dwc3 platform device").

-Ben

On Wed, Sep 23, 2026 at 04:10:21PM +0800, By wrote:
> A PCI driver_override bind can reach dwc3_pci_probe() with the dummy ID
> from pci_match_device(). Its driver_data is zero, so dwc3_pci_quirks()
> passes NULL to device_add_software_node(), which crashes in
> software_node_register().
> 
> Reject the match before enabling the device or allocating resources.
> All static DWC3 PCI IDs provide software-node data.
> 
> Build-tested with ARCH=arm64 defconfig and dwc3-pci.o. The runtime
> reproducer could not be run in this environment.
> 
> Fixes: e492ce9bcaa1 ("usb: dwc3: pci: Register a software node for the dwc3 platform device")
> Reported-by: syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=665bae0a102933788e1a
> Assisted-by: LLM
> Signed-off-by: By <xiaobai050@gmail.com>
> ---
>  drivers/usb/dwc3/dwc3-pci.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
> index 6c1cbb722..d7fdf6ca6 100644
> --- a/drivers/usb/dwc3/dwc3-pci.c
> +++ b/drivers/usb/dwc3/dwc3-pci.c
> @@ -335,6 +335,9 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
>  	int			ret;
>  	struct device		*dev = &pci->dev;
>  
> +	if (!id->driver_data)
> +		return -ENODEV;
> +
>  	ret = pcim_enable_device(pci);
>  	if (ret) {
>  		dev_err(dev, "failed to enable pci device\n");
> -- 
> 2.55.0

Re: [PATCH] usb: dwc3: pci: reject matches without software-node data

[Greg KH]

On Wed, Sep 23, 2026 at 04:10:06PM +0800, By wrote:
> A PCI driver_override bind can reach dwc3_pci_probe() with the dummy ID
> from pci_match_device(). Its driver_data is zero, so dwc3_pci_quirks()
> passes NULL to device_add_software_node(), which crashes in
> software_node_register().

As it should.  Don't do that.  See the archives for many details.

> Reported-by: syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com

This is an invalid report, as has been said in the past.

thanks,

greg k-h

[PATCH] usb: dwc3: pci: reject matches without software-node data

[By]

A PCI driver_override bind can reach dwc3_pci_probe() with the dummy ID
from pci_match_device(). Its driver_data is zero, so dwc3_pci_quirks()
passes NULL to device_add_software_node(), which crashes in
software_node_register().

Reject the match before enabling the device or allocating resources.
All static DWC3 PCI IDs provide software-node data.

Build-tested with ARCH=arm64 defconfig and dwc3-pci.o. The runtime
reproducer could not be run in this environment.

Fixes: e492ce9bcaa1 ("usb: dwc3: pci: Register a software node for the dwc3 platform device")
Reported-by: syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=665bae0a102933788e1a
Assisted-by: LLM
Signed-off-by: By <xiaobai050@gmail.com>
---
 drivers/usb/dwc3/dwc3-pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 6c1cbb722..d7fdf6ca6 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -335,6 +335,9 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 	int			ret;
 	struct device		*dev = &pci->dev;
 
+	if (!id->driver_data)
+		return -ENODEV;
+
 	ret = pcim_enable_device(pci);
 	if (ret) {
 		dev_err(dev, "failed to enable pci device\n");
-- 
2.55.0