usb: dwc3-pci: general protection fault in software_node_register during probe

Hi,

I am reporting a general protection fault on the dwc3-pci probe path, triggered by a syzkaller reproducer. The issue is reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).

The reproducer mounts sysfs, writes "dwc3-pci" to the driver_override attribute of PCI device 0000:00:03.0, unbinds the device, and then writes the device name to the driver's bind attribute. That forces the driver to probe a device without the firmware description it would normally be matched against.

The probe runs from the workqueue worker kworker/0:9 in the work_for_cpu_fn context. KASAN reports a null-ptr-deref in the range [0x8-0xf] and the console shows a general protection fault for the non-canonical address 0xdffffc0000000001, with RIP in software_node_register. The path is device_add_software_node -> software_node_register, reached from dwc3_pci_probe.

One possible cause is that the software node handed to device_add_software_node on this path has a NULL parent, which software_node_register then walks. This looks like a missing validation of the node relationship on the probe path rather than a fault caused by the PCI device itself. I am reporting the fault and the path as observed.

This appears to be a recurrence of the syzbot issue whose external id is 46e393fe0ffd5b550bca. It remains reproducible on v7.3-rc1.

Reproducer:

syz reproducer:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='dwc3-pci\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0000:00:03.0\x00', 0xd)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/dwc3-pci/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='0000:00:03.0\x00', 0xd)

console output: https://pastebin.com/raw/xRHP66Xp
kernel config: https://pastebin.com/raw/cJBbuYdY

Kernel:

HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)

Let me know if you need more details or testing.

Best regards,
Changjian