Re: [PATCH] usb: gadget: goku_udc: fix kobject warning on probe failure

[Cheng Lingfei <chenglingfei@foxmail.com>]

On 8/26/2026 2:11 PM, Greg Kroah-Hartman wrote:
> On Wed, Aug 26, 2026 at 11:35:58AM +0800, Cheng Lingfei wrote:
>> goku_probe() calls goku_remove() when hardware initialization fails, but
>> the gadget device is initialized only near the end of probe. As a result,
>> goku_remove() calls usb_del_gadget_udc(), which drops a reference to an
>> uninitialized gadget device and triggers a kobject warning.
>>
>> Initialize the gadget device immediately after allocating the controller,
>> but add it only after all hardware resources have been acquired. Track the
>> gadget and proc entry registration state so goku_remove() can safely clean
>> up both partial probe state and a fully initialized device.
>>
>> Use the split gadget removal API and drop the final gadget reference only
>> after all hardware resources have been released.
>>
>> Also obtain the controller from the embedded gadget device in the release
>> callback. Driver data is set on the PCI device rather than the gadget
>> device, so using dev_get_drvdata() there fails to free the controller.
>>
>> Use a per-device name for the debug proc entry so that multiple
>> controllers can be registered without colliding on /proc/driver/udc.
>>
>> Fixes: 3301c215a2bb ("USB: UDC: Expand device model API interface")
>> Reported-by: syzbot+06ec7624018233e17113@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=06ec7624018233e17113
>> Tested-by: syzbot+06ec7624018233e17113@syzkaller.appspotmail.com
>>
>> Signed-off-by: Cheng Lingfei <chenglingfei@foxmail.com>
> 
> No Assisted-by: line?
> 
> And do you see this happening in a real device and not just a fake one?
> 
> And why is this driver using proc at all, shouldn't that be in debugfs
> instead?
> 
> thanks,
> 
> greg k-h

Thanks for the review.

I do not have TC86C001 hardware. The issue was reproduced only by
syzbot, whose reproducer binds goku_udc to unrelated QEMU PCI devices
through the PCI new_id interface.

The probe cleanup path itself can also be reached on real hardware if
one of the probe steps fails, but I cannot claim that the issue has
been reproduced on real hardware.

The proc entry is legacy diagnostic code from this old driver, so I
agree that debugfs is the appropriate interface. I will rework the
patch accordingly and send a v2.

I will also add the missing Assisted-by line.