Re: [PATCH v3 2/2] usb: gadget: goku_udc: fix kobject warning on probe failure

[Cheng Lingfei <chenglingfei@foxmail.com>]

On 8/26/2026 5:27 PM, Greg Kroah-Hartman wrote:
> On Wed, Aug 26, 2026 at 05:15:07PM +0800, Cheng Lingfei wrote:
>> goku_probe() calls goku_remove() when hardware initialization fails, but
>> the gadget device is initialized only near the end of probe. As a result,
>> goku_remove() calls usb_del_gadget_udc(), which drops a reference to an
>> uninitialized gadget device and triggers a kobject warning.
>>
>> Initialize the gadget device immediately after allocating the controller,
>> but add it only after all hardware resources have been acquired. Track the
>> gadget registration state so goku_remove() can safely clean up both partial
>> probe state and a fully initialized device.
>>
>> Use the split gadget removal API and drop the final gadget reference only
>> after all hardware resources have been released. Obtain the controller from
>> the embedded gadget device in the release callback because driver data is
>> set on the PCI device rather than the gadget device.
>>
>> Fixes: 3301c215a2bb ("USB: UDC: Expand device model API interface")
>> Reported-by: syzbot+06ec7624018233e17113@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=06ec7624018233e17113
>> Tested-by: syzbot+06ec7624018233e17113@syzkaller.appspotmail.com
>> Assisted-by: Codex:gpt-5.6
>> Signed-off-by: Cheng Lingfei <chenglingfei@foxmail.com>
>> ---
>>   drivers/usb/gadget/udc/goku_udc.c | 28 ++++++++++++++--------------
>>   drivers/usb/gadget/udc/goku_udc.h |  3 ++-
>>   2 files changed, 16 insertions(+), 15 deletions(-)
>>
>> diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
>> index 5ad8633f522b..615cc6b8f354 100644
>> --- a/drivers/usb/gadget/udc/goku_udc.c
>> +++ b/drivers/usb/gadget/udc/goku_udc.c
>> @@ -20,6 +20,7 @@
>>   // #define	VERBOSE		/* extra debug messages (success too) */
>>   // #define	USB_TRACE	/* packet-level success messages */
>>   
>> +#include <linux/container_of.h>
>>   #include <linux/debugfs.h>
>>   #include <linux/kernel.h>
>>   #include <linux/module.h>
>> @@ -1726,7 +1727,7 @@ static irqreturn_t goku_irq(int irq, void *_dev)
>>   
>>   static void gadget_release(struct device *_dev)
>>   {
>> -	struct goku_udc	*dev = dev_get_drvdata(_dev);
>> +	struct goku_udc *dev = container_of(_dev, struct goku_udc, gadget.dev);
> 
> That looks wrong.  If it is correct, please create a proper macro for it
> so that you verify that this all is working properly.

The object allocated by goku_probe() is struct goku_udc, with struct 
usb_gadget embedded in it. Therefore, when the gadget release callback 
is invoked with a pointer to the embedded gadget.dev, it must recover 
and free the enclosing struct goku_udc.
This follows the same pattern used by the net2280 and fsl_qe_udc 
drivers. I agree that the conversion should be made explicit, so I will 
add a helper macro in the next revision:

#define to_goku_udc(g) \
	container_of((g), struct goku_udc, gadget)

#define gadget_dev_to_goku_udc(d) \
	to_goku_udc(dev_to_usb_gadget(d))

-- 
Best regards,
Cheng Lingfei