get_alias_quirk() resolves a quirk for an aliased USB ID by scanning
usb_audio_ids[], but it currently checks only the vendor/product pair.
This is weak for quirk table entries that also depend on additional
USB_DEVICE_ID match fields, such as device or interface class,
subclass, protocol, interface number, or bcdDevice range.
Keep the aliased vid:pid as the lookup key, then validate only the
remaining match criteria of each candidate entry against the real
device/interface descriptors by clearing USB_DEVICE_ID_MATCH_DEVICE
from a temporary copy and passing it to usb_match_one_id().
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260318-alsa-usb-fix-quirk-alias-v3-1-bd3b17a32939@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
clang-22 rightfully warns that the memcpy() in adapter_prepare() copies
between different structures, crossing the boundary of nested
structures inside it:
In file included from sound/pci/asihpi/hpimsgx.c:13:
In file included from include/linux/string.h:386:
include/linux/fortify-string.h:569:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
569 | __write_overflow_field(p_size_field, size);
The two structures seem to refer to the same layout, despite the
separate definitions, so the code is in fact correct.
Avoid the warning by copying the two inner structures separately.
I see the same pattern happens in other functions in the same file,
so there is a chance that this may come back in the future, but
this instance is the only one that I saw in practice, hitting it
multiple times per day in randconfig build.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260318124016.3488566-1-arnd@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add missing blank lines after variable declarations in several files
throughout the rtl8723bs driver to comply with kernel coding style.
Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260314122325.7877-1-rayfraytech@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Break a long function call across two lines in order to make code
easier to read and also comply with the Linux coding style.
Problem was found using checkpatch.pl tool.
Signed-off-by: Andrea Poldi <andrea@riposetti.com>
Link: https://patch.msgid.link/20260317165845.12594-1-andrea@riposetti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Combine the return value checks for _FAIL and RTW_RX_HANDLED into a
single logical OR statement and remove unnecessary braces. This improves
code readability and resolves the following checkpatch.pl warning:
"WARNING: braces {} are not necessary for any arm of this statement"
Signed-off-by: Giacomo Di Clerico <giacomodiclerico@gmail.com>
Link: https://patch.msgid.link/20260317100723.72476-1-giacomodiclerico@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace msleep(10) with fsleep(10 * USEC_PER_MSEC)
in _rtw_init_xmit_priv().
fsleep() is the new standard API for delays, as it automatically chooses
the best sleep method based on the duration.
Suggested-by: Ethan Tidmore <ethantidmore06@gmail.com>
Signed-off-by: Marcos Andrade <marcosandrade95963@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260316221924.4904-3-marcosandrade95963@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace hardcoded magic numbers for network protocols (e.g., 0x0806
for ARP, 0x888e for EAPOL) with their standard EtherType macro
equivalents (ETH_P_ARP, ETH_P_PAE) defined in <linux/if_ether.h>.
This change improves code readability and aligns the driver with
standard Linux networking definitions.
Signed-off-by: Marcos Andrade <marcosandrade95963@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260316221924.4904-2-marcosandrade95963@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eqNByte() function is a redundant reimplementation of strcmp().
Remove eqNByte() and switch its usages to strcmp().
No functional change.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bera Yüzlü <b9788213@gmail.com>
Link: https://patch.msgid.link/20260309184556.846-2-b9788213@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove several global efuse variables from rtw_efuse.c and their
corresponding extern declarations in rtw_efuse.h.
These variables (fakeEfuseBank, BTEfuseUsedBytes, etc.) are completely
unused legacy code. The driver currently maintains the efuse state
properly within the 'efuse_hal' structure, which is encapsulated
inside 'hal_com_data'.
The removal of this dead code cleans up the global namespace and
resolves multiple checkpatch.pl warnings regarding CamelCase naming
conventions. Verified by compilation that no functional code references
these variables.
Signed-off-by: Marcos Andrade <marcosandrade95963@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260316220435.2249-1-marcosandrade95963@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the 'NDIS_802_11_MAC_ADDRESS' type and replace all variables of
this type with an array of 'u8', which will make the code more
understandable and get rid of unnecessary 'typedef'.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260316113427.3696-1-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The ETH_ALEN macro is already declared in the Kernel headers, so there
is no need to redefine it here.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260315131734.25054-1-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The gb_dev_loopback_ro_attr macro accepted a 'conn' argument which
was never used in its expansion. Remove it from both the macro
definition and its invocation.
Signed-off-by: Giacomo Di Clerico <giacomodiclerico@gmail.com>
Link: https://patch.msgid.link/20260315105853.34609-1-giacomodiclerico@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove a space in the line start to follow kernel coding style.
Reported by checkpatch.pl.
Signed-off-by: Bera Yüzlü <b9788213@gmail.com>
Reviewed-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260310125556.874-2-b9788213@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
As per the kernel's documentation, sysfs_emit() is the preferred way
to format strings for sysfs attributes. It handles buffer overruns
safely. Replace sprintf calls with sysfs_emit across all loopback
sysfs show macros.
Signed-off-by: Luis Soza Rodriguez <contact@sluisr.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20260309230507.4931-1-contact@sluisr.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
An unreachable default case calls BUG(). Remove the entire default case,
as the three possible cases are already addressed.
Signed-off-by: Mark Adamenko <marusik.adamenko@gmail.com>
Link: https://patch.msgid.link/20260310014514.40293-1-marusik.adamenko@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Function rtw_linked_check() always return 'bool' value, but it's type
'int'. Replace 'int' with 'bool' to make it more accurate.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260309201257.16984-5-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Function rtw_is_desired_network() used only in rtw_mlme.c file and
always return 'true' or 'false', so it's type can be replaced
with 'static bool'.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260309201257.16984-4-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Function rtw_is_same_ibss() returns a 'bool' value, but has an 'int
type. Replace 'int' -> 'bool' types to make it more accrurate.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260309201257.16984-3-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Function rtw_if_up() actually return 'bool' value, but it's type is
'signed int'. Replace 'signed int' with 'bool' to make it more accurate.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260309201257.16984-2-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The tip tree handbook is a pretty handy reference for keeping the
various tip maintainers happy. But there are no references to it
in the MAINTAINERS file.
Add a references to the handbook for a number of subsystems. I've
added these for all of the obvious subsystems that list T:.../tip.git
and are likely to follow the tip rules.
This will be useful both for humans digging in the MAINTAINERS file
and our new AI bot overlords.
I'm cc'ing all the M:'s and L:'s listed for the subsystems but leaving
off the R:'s because the cc list is already out of control. I'll
commit this to *some* tip branch if there's general consensus that
this is a good idea.
[ dhansen: add objtool and futexes at peterz's urging ]
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Boqun Feng <boqun@kernel.org>
Acked-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260305212215.3188399-1-dave.hansen@linux.intel.com
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
The firmware drivers for ARM SCMI, FF-A and the Tee subsystem, as well
as the reset controller and cache controller subsystem all see small
bugfixes for reference ounting errors, ABI correctness, and NULL pointer
dereferences.
Similarly, there are multiple reference counting fixes in drivers/soc/
for vendor specific drivers (rockchips, microchip), while the freescale
drivers get a fix for a race condition and error handling.
The devicetree fixes for Rockchips and NXP got held up, so for the moment
there is only Renesas fixing problesm with SD card initialization, a
boot hang on one board and incorrect descriptions for interrupts and
clock registers on some SoCs. The Microchip polarfire gets a dts fix
for a boot time warning.
A defconfig fix avoids a warning about a conflicting assignment.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmm6q2YACgkQmmx57+YA
GNmRRw//azD1CFBExxu6Q4f/N3mlGlnUrFO4wDojQFeYhU2zN6hVFNswNu1ZCpjc
7KEO3d73XDn79CaoD+BSTuX5eRzkhFNB5FsmOauPaUvG34JdpYWnpvwTiOa826sf
otJpkX036o7jpU/K37sP4ijcoa1jvxcFxLua5twS4OskoPneIsuIfVL8oSw+r+Qo
ohTMzdp+Y3ISRNLcf9OtLD2ZOTGTkNnJ1Sa7uCJZ7KDKB9qmi3lQorDM02yxKwAL
vkv5dzcMzh4c95hxIvSx2+eocHDVXWmRDOi2rJ0Y24YM/QzLFg9WdkiL6DpoMEpA
dV+bm2t/D1mBrNn33hhxGHgpreYRrH0K9RnVpW+oQLc39suokAkrsxSjzFgOcbvF
PQ1Jt6fWfm9AHUgHuScFIQrMwylb2yHSSb+1pLtm+olyfr+x0LOJB8QynaIHmcdH
5mhM6cY+i20kJN3ZpbADu+dZAdqpiu4Z0U9ceCFubUxtD4bSWifuDU0XsP6jSz9I
8xuL28vH5N0ECNGvEfPyq2SovCb8T6wVmSAgTk2bnrKQK7sk9tYEnm+KVXmNt6N8
TAag8JoU0wBXF2sNo0Q6+A+vIqingD9BAyqScjpnb/a4BAsYcUBd37w36HBwX5dm
lk3LoVdnQWnks9xnG9C6RfMOwU7xhceZiLMEvVUWVH9c0dueUTQ=
=CN0w
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"The firmware drivers for ARM SCMI, FF-A and the Tee subsystem, as
well as the reset controller and cache controller subsystem all see
small bugfixes for reference ounting errors, ABI correctness, and
NULL pointer dereferences.
Similarly, there are multiple reference counting fixes in drivers/soc/
for vendor specific drivers (rockchips, microchip), while the
freescale drivers get a fix for a race condition and error handling.
The devicetree fixes for Rockchips and NXP got held up, so for
the moment there is only Renesas fixing problesm with SD card
initialization, a boot hang on one board and incorrect descriptions
for interrupts and clock registers on some SoCs. The Microchip
polarfire gets a dts fix for a boot time warning.
A defconfig fix avoids a warning about a conflicting assignment"
* tag 'soc-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits)
ARM: multi_v7_defconfig: Drop duplicate CONFIG_TI_PRUSS=m
firmware: arm_scmi: Spelling s/mulit/multi/, s/currenly/currently/
firmware: arm_scmi: Fix NULL dereference on notify error path
firmware: arm_scpi: Fix device_node reference leak in probe path
firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
arm64: dts: renesas: r8a78000: Fix out-of-range SPI interrupt numbers
arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2
arm64: dts: renesas: r9a09g087: Fix CPG register region sizes
arm64: dts: renesas: r9a09g077: Fix CPG register region sizes
arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator
arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator
tee: shm: Remove refcounting of kernel pages
reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it
soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources()
soc: fsl: qbman: fix race condition in qman_destroy_fq
soc: rockchip: grf: Add missing of_node_put() when returning
cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
cache: starfive: fix device node leak in starlink_cache_init()
riscv: dts: microchip: add can resets to mpfs
...
If a runtime suspend is executed followed by a system suspend, the driver
may invoke dwc3_imx_suspend() twice, which causes enable_irq() to be
called twice as well. This leads to an unbalanced IRQ state and may
trigger warnings or malfunction. Prevent this by checking the pm_suspended
flag before running the imx suspend/resume path.
Fixes: 76fc9452a6 ("usb: dwc3: introduce flatten model driver of i.MX Soc")
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260317030546.1665206-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When a gadget request is only partially transferred in transfer()
because the per-frame bandwidth budget is exhausted, the loop advances
to the next queued request. If that next request is a zero-length
packet (ZLP), len evaluates to zero and the code takes the
unlikely(len == 0) path, which sets is_short = 1. This bypasses the
bandwidth guard ("limit < ep->ep.maxpacket && limit < len") that
lives in the else branch and would otherwise break out of the loop for
non-zero requests. The is_short path then completes the URB before all
data from the first request has been transferred.
Reproducer (bulk IN, high speed):
Device side (FunctionFS with Linux AIO):
1. Queue a 65024-byte write via io_submit (127 * 512, i.e. a
multiple of the HS bulk max packet size).
2. Immediately queue a zero-length write (ZLP) via io_submit.
Host side:
3. Submit a 65536-byte bulk IN URB.
Expected: URB completes with actual_length = 65024.
Actual: URB completes with actual_length = 53248, losing 11776
bytes that leak into subsequent URBs.
At high speed the per-frame budget is 53248 bytes (512 * 13 * 8).
The 65024-byte request exhausts this budget after 53248 bytes, leaving
the request incomplete (req->req.actual < req->req.length). Neither
the request nor the URB is finished, and rescan is 0, so the loop
advances to the ZLP. For the ZLP, dev_len = 0, so len = min(12288, 0)
= 0, taking the unlikely(len == 0) path and setting is_short = 1.
The is_short handler then sets *status = 0, completing the URB with
only 53248 of the expected 65024 bytes.
Fix this by breaking out of the loop when the current request has
remaining data (req->req.actual < req->req.length). The request
resumes on the next timer tick, preserving correct data ordering.
Signed-off-by: Sebastian Urban <surban@surban.net>
Cc: stable <stable@kernel.org>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260315151045.1155850-1-surban@surban.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When syscon_regmap_lookup_by_phandle_args() fails, the function was
returning directly without cleaning up the power domain initialized
earlier by dwc3_google_pm_domain_init().
Fix by jumping to err_deinit_pdom to properly clean up resources.
Fixes: 8995a37371 ("usb: dwc3: Add Google Tensor SoC DWC3 glue driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260316-dwc3-google-v1-1-c9bde1b02f62@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This device has a union descriptor that is just garbage
and needs a custom descriptor.
In principle this could be done with a (conditionally
activated) heuristic. That would match more devices
without a need for defining a new quirk. However,
this always carries the risk that the heuristics
does the wrong thing and leads to more breakage.
Defining the quirk and telling it exactly what to do
is the safe and conservative approach.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260317084139.1461008-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit ec35c19696 ("usb: gadget: f_ncm: Fix net_device lifecycle with
device_move") reparents the gadget device to /sys/devices/virtual during
unbind, clearing the gadget pointer. If the userspace tool queries on
the surviving interface during this detached window, this leads to a
NULL pointer dereference.
Unable to handle kernel NULL pointer dereference
Call trace:
eth_get_drvinfo+0x50/0x90
ethtool_get_drvinfo+0x5c/0x1f0
__dev_ethtool+0xaec/0x1fe0
dev_ethtool+0x134/0x2e0
dev_ioctl+0x338/0x560
Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached,
skip copying the fw_version and bus_info strings, which is natively
handled by ethtool_get_drvinfo for empty strings.
Suggested-by: Val Packett <val@packett.cool>
Reported-by: Val Packett <val@packett.cool>
Closes: https://lore.kernel.org/linux-usb/10890524-cf83-4a71-b879-93e2b2cc1fcc@packett.cool/
Fixes: ec35c19696 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move")
Cc: stable <stable@kernel.org>
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260316-eth-null-deref-v1-1-07005f33be85@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This fixes an error in synchronization in the dummy-hcd driver. The
error has a somewhat involved history. The synchronization mechanism
was introduced by commit 7dbd8f4cab ("USB: dummy-hcd: Fix erroneous
synchronization change"), which added an emulated "interrupts enabled"
flag together with code emulating synchronize_irq() (it waits until
all current handler callbacks have returned).
But the emulated interrupt-disable occurred too late, after the driver
containing the handler callback routines had been told that it was
unbound and no more callbacks would occur. Commit 4a5d797a9f ("usb:
gadget: dummy_hcd: fix gpf in gadget_setup") tried to fix this by
moving the synchronize_irq() emulation code from dummy_stop() to
dummy_pullup(), which runs before the unbind callback.
There still were races, though, because the emulated interrupt-disable
still occurred too late. It couldn't be moved to dummy_pullup(),
because that routine can be called for reasons other than an impending
unbind. Therefore commits 7dc0c55e9f ("USB: UDC core: Add
udc_async_callbacks gadget op") and 04145a03db ("USB: UDC: Implement
udc_async_callbacks in dummy-hcd") added an API allowing the UDC core
to tell dummy-hcd exactly when emulated interrupts and their callbacks
should be disabled.
That brings us to the current state of things, which is still wrong
because the emulated synchronize_irq() occurs before the emulated
interrupt-disable! That's no good, beause it means that more emulated
interrupts can occur after the synchronize_irq() emulation has run,
leading to the possibility that a callback handler may be running when
the gadget driver is unbound.
To fix this, we have to move the synchronize_irq() emulation code yet
again, to the dummy_udc_async_callbacks() routine, which takes care of
enabling and disabling emulated interrupt requests. The
synchronization will now run immediately after emulated interrupts are
disabled, which is where it belongs.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 04145a03db ("USB: UDC: Implement udc_async_callbacks in dummy-hcd")
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/c7bc93fe-4241-4d04-bd56-27c12ba35c97@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Syzbot testing was able to provoke an addressing exception and crash
in the usb_gadget_udc_reset() routine in
drivers/usb/gadgets/udc/core.c, resulting from the fact that the
routine was called with a second ("driver") argument of NULL. The bad
caller was set_link_state() in dummy_hcd.c, and the problem arose
because of a race between a USB reset and driver unbind.
These sorts of races were not supposed to be possible; commit
7dbd8f4cab ("USB: dummy-hcd: Fix erroneous synchronization change"),
along with a few followup commits, was written specifically to prevent
them. As it turns out, there are (at least) two errors remaining in
the code. Another patch will address the second error; this one is
concerned with the first.
The error responsible for the syzbot crash occurred because the
stop_activity() routine will sometimes drop and then re-acquire the
dum->lock spinlock. A call to stop_activity() occurs in
set_link_state() when handling an emulated USB reset, after the test
of dum->ints_enabled and before the increment of dum->callback_usage.
This allowed another thread (doing a driver unbind) to sneak in and
grab the spinlock, and then clear dum->ints_enabled and dum->driver.
Normally this other thread would have to wait for dum->callback_usage
to go down to 0 before it would clear dum->driver, but in this case it
didn't have to wait since dum->callback_usage had not yet been
incremented.
The fix is to increment dum->callback_usage _before_ calling
stop_activity() instead of after. Then the thread doing the unbind
will not clear dum->driver until after the call to
usb_gadget_udc_reset() safely returns and dum->callback_usage has been
decremented again.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/68fc7c9c.050a0220.346f24.023c.GAE@google.com/
Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Fixes: 7dbd8f4cab ("USB: dummy-hcd: Fix erroneous synchronization change")
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/46135f42-fdbe-46b5-aac0-6ca70492af15@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a
7-bit field (0-127) that is used to index into the connector array in
ucsi_connector_change(). However, the array is only allocated for the
number of connectors reported by the device (typically 2-4 entries).
A malicious or malfunctioning device could report an out-of-range
connector number in the CCI, causing an out-of-bounds array access in
ucsi_connector_change().
Add a bounds check in ucsi_notify_common(), the central point where CCI
is parsed after arriving from hardware, so that bogus connector numbers
are rejected before they propagate further.
Fixes: bdc62f2bae ("usb: typec: ucsi: Simplified registration and I/O API")
Cc: stable <stable@kernel.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
Link: https://patch.msgid.link/20260313222453.123-1-nathan.c.rebello@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
A race condition between gether_disconnect() and eth_stop() leads to a
NULL pointer dereference. Specifically, if eth_stop() is triggered
concurrently while gether_disconnect() is tearing down the endpoints,
eth_stop() attempts to access the cleared endpoint descriptor, causing
the following NPE:
Unable to handle kernel NULL pointer dereference
Call trace:
__dwc3_gadget_ep_enable+0x60/0x788
dwc3_gadget_ep_enable+0x70/0xe4
usb_ep_enable+0x60/0x15c
eth_stop+0xb8/0x108
Because eth_stop() crashes while holding the dev->lock, the thread
running gether_disconnect() fails to acquire the same lock and spins
forever, resulting in a hardlockup:
Core - Debugging Information for Hardlockup core(7)
Call trace:
queued_spin_lock_slowpath+0x94/0x488
_raw_spin_lock+0x64/0x6c
gether_disconnect+0x19c/0x1e8
ncm_set_alt+0x68/0x1a0
composite_setup+0x6a0/0xc50
The root cause is that the clearing of dev->port_usb in
gether_disconnect() is delayed until the end of the function.
Move the clearing of dev->port_usb to the very beginning of
gether_disconnect() while holding dev->lock. This cuts off the link
immediately, ensuring eth_stop() will see dev->port_usb as NULL and
safely bail out.
Fixes: 2b3d942c48 ("usb ethernet gadget: split out network core")
Cc: stable <stable@kernel.org>
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260311-gether-disconnect-npe-v1-1-454966adf7c7@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add two new members to the power_supply_usb_type to represent the
USB Power Delivery (PD) Standard Power Range (SPR) Adjustable Voltage
Supply (AVS) charging types:
POWER_SUPPLY_USB_TYPE_PD_SPR_AVS: For devices supporting only the
PD SPR AVS type.
POWER_SUPPLY_USB_TYPE_PD_PPS_SPR_AVS: For devices that support both
PD Programmable Power Supply (PPS) and PD SPR AVS.
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://patch.msgid.link/20260316150301.3892223-3-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB Power Delivery 3.2 introduces a new power supply type SPR AVS.
Add macro definitions for the USB Power Delivery (PD)
Standard Power Range (SPR) Adjustable Voltage Supply (AVS) as a
Sink Augmented Power Data Object (APDO) in the device tree bindings.
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260316150301.3892223-2-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The fields 'priority' and 'mode_selection' in struct typec_altmode are
missing from the kernel-doc comment, which results in warnings when
building the documentation with 'make htmldocs'.
WARNING: ./include/linux/usb/typec_altmode.h:44 struct member 'priority' not described in 'typec_altmode'
WARNING: ./include/linux/usb/typec_altmode.h:44 struct member 'mode_selection' not described in 'typec_altmode'
Document both fields to keep the kernel-doc comment aligned with the
structure definition.
Signed-off-by: Aldo Conte <aldocontelk@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260311163320.61534-1-aldocontelk@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmm3dOwWHGNoZW5odWFj
YWlAa2VybmVsLm9yZwAKCRAChivD8uImeq4xD/93IjyPYo5tmvQO+9AcdahH2lON
z1mlOcGojmoeIa94c0z1L0GfracdygLiEgeIGieFeri6usAIFbQjqpj2J4bS/6xn
/ML/yRO5wL9Z5j+9FiQf9YBISVxigMo4QdTBeXimt0Banlfn3GO7E9xNASMM9Gnt
naD+o4umSWZLR2kxUp8urrNw6odJnlCL3rXhZchXO9poMIdRT6yZhOU040pgWpqz
4iH6vp59v3Mq6pszbJ7v7Zv9c836Dl+mFCbCemgbu4yCgVpn2akLMrj8suxC5+Fm
kolI+hdq9FGMzCmotMb0onOMdb4ej/XkpA5J3xmke8maQxZMf2KjhLIgQ+eZZjC6
bY48QKYnbMbS8CnDK24ejZKzfIaUQ1cNJ9hiFE3IkgP7U6Fs85XzoLRUMD4zEqBs
bE6FpERbJDs6YkE3IYO9f9W8c6hUv+2Di4FaIOnUSd8wY7K5a8yb0ptfa/S77Wcl
GOV3dRSAQFnMglxnIxzJoiRjsPRX64XyNcHCDEYThTWSaZHAaVXmXGayYFPNcjCq
jbf6rLWmpR77hjJfr8tUA+KOcJ+dDczHsn6xNUcK0+j0UcrDcj03mIHrc7QdFMnS
d6+tnRQq8x2iQgoCh2axQ7aZCiGgePu/GfLIt/t3AoM14xfN+dr80YLOdy2YsT0U
CwvqsgOjpVw62uhGUw==
=AN9K
-----END PGP SIGNATURE-----
Merge tag 'loongarch-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch fixes from Huacai Chen:
- only use SC.Q when supported by the assembler to fix a build failure
- fix calling smp_processor_id() in preemptible code
- make a BPF helper arch_protect_bpf_trampoline() return 0 to fix a
kernel memory access failure
- fix a typo issue in kvm_vm_init_features()
* tag 'loongarch-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
LoongArch: KVM: Fix typo issue in kvm_vm_init_features()
LoongArch: BPF: Make arch_protect_bpf_trampoline() return 0
LoongArch: No need to flush icache if text copy failed
LoongArch: Check return values for set_memory_{rw,rox}
LoongArch: Give more information if kmem access failed
LoongArch: Fix calling smp_processor_id() in preemptible code
LoongArch: Only use SC.Q when supported by the assembler
The debug outputs use %d for clock rates resulting in negative clock rate
during rate calculation.
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://patch.msgid.link/20260317121953.1100619-1-alexander.stein@ew.tq-group.com
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Static structure "ti_tusb8041_data" is exactly the same as
"ti_tusb8020b_data" and "cypress_hx2vl_data" is the same as
"microchip_usb424_data". Drop the duplicated structures to reduce
driver size and memory usage without affecting functionality.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260318084626.34314-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When a port is disabled, an attached device will be disconnected. This
causes a port-status-change event, which will race with hub autosuspend
(if the disabled port was the only connected port on its hub), causing
an immediate resume and a second autosuspend. Both of these can be
avoided by adding a short delay after the call to
usb_hub_set_port_power().
Below log shows what is happening:
$ echo 1 > usb1-port1/disable
[ 37.958239] usb 1-1: USB disconnect, device number 2
[ 37.964101] usb 1-1: unregistering device
[ 37.970070] hub 1-0:1.0: hub_suspend
[ 37.971305] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0002
[ 37.974412] usb usb1: bus auto-suspend, wakeup 1
[ 37.988175] usb usb1: suspend raced with wakeup event <---
[ 37.993947] usb usb1: usb auto-resume
[ 37.998401] hub 1-0:1.0: hub_resume
[ 38.105688] usb usb1-port1: status 0000, change 0000, 12 Mb/s
[ 38.112399] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0000
[ 38.118645] hub 1-0:1.0: hub_suspend
[ 38.122963] usb usb1: bus auto-suspend, wakeup 1
[ 38.200368] usb usb1: usb wakeup-resume
[ 38.204982] usb usb1: usb auto-resume
[ 38.209376] hub 1-0:1.0: hub_resume
[ 38.213676] usb usb1-port1: status 0101 change 0001
[ 38.321552] hub 1-0:1.0: state 7 ports 1 chg 0002 evt 0000
[ 38.327978] usb usb1-port1: status 0101, change 0000, 12 Mb/s
[ 38.457429] usb 1-1: new high-speed USB device number 3 using ci_hdrc
Then, port change bit will be fixed to the final state and
usb_clear_port_feature() can correctly clear it after this period. This
will also avoid usb runtime suspend routine to run because
usb_autopm_put_interface() not run yet.
Fixes: f061f43d74 ("usb: hub: port: add sysfs entry to switch port power")
Cc: stable@kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260316095042.1559882-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB core only relaxes the default PM_QOS_FLAG_NO_POWER_OFF policy when
an upstream hub reports switchable port power. That misses internal
ports whose power is managed by platform firmware instead of the USB
hub descriptor.
Allow the port-poweroff policy to be exposed for hard-wired ports with
an ACPI-managed power resource. The existing runtime PM path still
requires the child usage count to drop and remote wakeup to be clear
before it will power the port down.
This lets internal devices such as CNVi Bluetooth use the existing USB
ACPI runtime power path even when the root hub reports no USB-standard
port power switching.
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Link: https://patch.msgid.link/20260315223433.23452-1-sean@starlabs.systems
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Instead of "shrinking" the allocation by kmalloc()ing a new, smaller
buffer, utilize krealloc() to shrink the existing allocation. This saves
a memcpy(), as well as eliminates the temporary `smallbuf` allocation,
which guards against allocation failure under extreme memory pressure.
Signed-off-by: Bence Csókás <bence98@sch.bme.hu>
Link: https://patch.msgid.link/20260315-usb-krealloc-v2-1-32f83e090409@sch.bme.hu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add the ID entries and platform data for the Corechips SL6341 onboard
USB 2.0/3.0 hub controller, which requires a reset pin and a power supply
for proper operation.
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Link: https://patch.msgid.link/20260311-sl6341-v1-3-0a890056f054@flipper.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Corechips SL6341 is a 4-port low-power USB 3.2 Gen 1x1 hub controller
supporting SS, HS, FS and LS connections and integrating a 5V to 3.3V
built-in LDO to enable its IO to be powered directly from the 5V USB VBUS.
External 1v1 VDD supply is still required for its core power.
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260311-sl6341-v1-2-0a890056f054@flipper.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
