[BUG] usb: dwc3-pci: general protection fault in software_node_register during probe

[BUG] usb: dwc3-pci: general protection fault in software_node_register during probe

[CJ]

Hi,


I am reporting a general protection fault on the dwc3-pci probe path, triggered
by a syzkaller reproducer.  The issue is reproducible with HEAD commit
cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts sysfs, writes "dwc3-pci" to the driver_override attribute
of PCI device 0000:00:03.0, unbinds the device, and then writes the device name
to the driver's bind attribute.  That forces the driver to probe a device
without the firmware description it would normally be matched against.


The probe runs from the workqueue worker kworker/0:9 in the work_for_cpu_fn
context.  KASAN reports a null-ptr-deref in the range [0x8-0xf] and the console
shows a general protection fault for the non-canonical address
0xdffffc0000000001, with RIP in software_node_register.  The path is
device_add_software_node -> software_node_register, reached from dwc3_pci_probe.


One possible cause is that the software node handed to
device_add_software_node on this path has a NULL parent, which
software_node_register then walks.  This looks like a missing validation of the
node relationship on the probe path rather than a fault caused by the PCI
device itself.  I am reporting the fault and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
46e393fe0ffd5b550bca.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='dwc3-pci\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='0000:00:03.0\x00', 0xd)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/dwc3-pci/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='0000:00:03.0\x00', 0xd)


console output: https://pastebin.com/raw/xRHP66Xp
kernel config: https://pastebin.com/raw/cJBbuYdY


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian