--- /dev/null
+From 69ee44e1a23be62318189dc4b37fa4ad94053269 Mon Sep 17 00:00:00 2001
+From: Baul Lee <baul.lee@xbow.com>
+Date: Wed, 5 Aug 2026 10:34:41 +0900
+Subject: ALSA: usb-audio: fix OOB write on Type II inbound URBs
+
+From: Baul Lee <baul.lee@xbow.com>
+
+commit 69ee44e1a23be62318189dc4b37fa4ad94053269 upstream.
+
+data_ep_set_params() sizes each URB transfer buffer before it adds the
+Format Type II transfer delimiter:
+
+ u->packets = urb_packs;
+ u->buffer_size = maxsize * u->packets;
+
+ if (fmt->fmt_type == UAC_FORMAT_TYPE_II)
+ u->packets++; /* for transfer delimiter */
+ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
+
+buffer_size is computed from the pre-increment packet count and never
+recomputed, so for a Type II endpoint the buffer is one packet short of
+the packet count the URB is built with.
+
+prepare_inbound_urb() then lays out one iso frame per packet and never
+consults buffer_size:
+
+ offs = 0;
+ for (i = 0; i < urb_ctx->packets; i++) {
+ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = ep->curpacksize;
+ offs += ep->curpacksize;
+ }
+
+ urb->transfer_buffer_length = offs;
+ urb->number_of_packets = urb_ctx->packets;
+
+The last descriptor therefore points one packet past the end of the
+transfer buffer, where the host controller writes device data on every
+inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound
+their fill loops by ctx->buffer_size, so only capture is affected.
+
+fmt_type comes from the device's audio streaming descriptors, so any
+device advertising a Type II capture format hits this once userspace sets
+hw_params on the stream.
+
+KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report
+per inbound transfer:
+
+ BUG: KASAN: slab-out-of-bounds in dummy_timer
+ Write of size 64 at addr ffff0000186171c0 by task cons02/166
+ __asan_memcpy
+ dummy_timer
+ hrtimer_run_softirq
+ Allocated by task 166:
+ usb_alloc_coherent
+ snd_usb_endpoint_set_params
+ The buggy address is located 0 bytes to the right of
+ allocated 64-byte region [ffff000018617180, ffff0000186171c0)
+
+Compute buffer_size after the delimiter packet has been accounted for,
+and bound the fill loop by buffer_size, as prepare_silent_urb() already
+does on the outbound side. This grows every Type II URB allocation by
+one maxsize packet.
+
+Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
+
+Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260805013441.38245-1-baul.lee@xbow.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -385,13 +385,15 @@ static int prepare_inbound_urb(struct sn
+ case SND_USB_ENDPOINT_TYPE_DATA:
+ offs = 0;
+ for (i = 0; i < urb_ctx->packets; i++) {
++ if (offs + ep->curpacksize > urb_ctx->buffer_size)
++ break;
+ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = ep->curpacksize;
+ offs += ep->curpacksize;
+ }
+
+ urb->transfer_buffer_length = offs;
+- urb->number_of_packets = urb_ctx->packets;
++ urb->number_of_packets = i;
+ break;
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+@@ -1243,10 +1245,10 @@ static int data_ep_set_params(struct snd
+ u->index = i;
+ u->ep = ep;
+ u->packets = urb_packs;
+- u->buffer_size = maxsize * u->packets;
+
+ if (fmt->fmt_type == UAC_FORMAT_TYPE_II)
+ u->packets++; /* for transfer delimiter */
++ u->buffer_size = maxsize * u->packets;
+ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
+ if (!u->urb)
+ goto out_of_memory;
--- /dev/null
+From 3abd29c61d2ef37c4102cf755b18be53bb9dbea6 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 3 Aug 2026 18:41:49 -0700
+Subject: Input: evdev - sanitize event type index when fetching event masks
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 3abd29c61d2ef37c4102cf755b18be53bb9dbea6 upstream.
+
+The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
+ioctls is used to index the static counts array in evdev_get_mask_cnt()
+and client evmasks array in evdev_get_mask().
+
+While the event type is architecturally bounded by EV_CNT, speculative
+execution may mispredict bounds checks and perform out-of-bounds loads.
+
+Sanitize the event type index in evdev_get_mask_cnt() branchlessly using
+array_index_mask_nospec(). This clamps the index to 0 for safe array
+access and forces the returned count to 0 speculatively when the index
+is out of bounds.
+
+We do not need additional array_index_nospec() calls in evdev_get_mask()
+because evdev_get_mask_cnt() speculatively forces the count (and
+resulting xfer_size) to 0 for out-of-bounds types, preventing any
+speculative memory access to client evmasks array.
+
+Reported-by: "Wagenaar, C.C.J. (Chris)" <c.c.j.wagenaar@vu.nl>
+Cc: stable@vger.kernel.org
+Assisted-by: Antigravity:gemini-3.6-flash
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/anFCAfvxwXB5eJF1@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/evdev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -21,6 +21,7 @@
+ #include <linux/init.h>
+ #include <linux/input/mt.h>
+ #include <linux/major.h>
++#include <linux/nospec.h>
+ #include <linux/device.h>
+ #include <linux/cdev.h>
+ #include "input-compat.h"
+@@ -67,8 +68,10 @@ static size_t evdev_get_mask_cnt(unsigne
+ [EV_SND] = SND_CNT,
+ [EV_FF] = FF_CNT,
+ };
++ unsigned long mask = array_index_mask_nospec(type, EV_CNT);
+
+- return (type < EV_CNT) ? counts[type] : 0;
++ /* Returns 0 for out-of-bounds types, including speculatively */
++ return counts[type & mask] & mask;
+ }
+
+ /* requires the buffer lock to be held */
--- /dev/null
+From 3874892dd27d5387aa9a06f58d9060f18f351d24 Mon Sep 17 00:00:00 2001
+From: Dongli Zhang <dongli.zhang@oracle.com>
+Date: Sun, 2 Aug 2026 15:46:12 -0700
+Subject: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+commit 3874892dd27d5387aa9a06f58d9060f18f351d24 upstream.
+
+The commit 4f61f133f354 ("net: tap: NULL pointer derefence in
+dev_parse_header_protocol when skb->dev is null") fixed a crash in
+tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb().
+This is required because virtio_net_hdr_to_skb() may invoke
+dev_parse_header_protocol(), which dereferences skb->dev. Without the
+assignment, a NULL pointer dereference can occur.
+
+However, tap_get_user_xdp() still parses the virtio-net header before
+assigning skb->dev. When the vhost TX path passes an XDP buffer containing
+a GSO virtio-net header but the protocol is set to zero on purpose,
+tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev
+is still NULL, resulting in a crash.
+
+Fix this by looking up the tap device and assigning skb->dev before calling
+tun_vnet_hdr_to_skb(), matching the ordering already used in
+tap_get_user(). Preserve the existing RCU read-side critical section across
+dev_queue_xmit().
+
+Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://patch.msgid.link/20260802224612.264563-1-dongli.zhang@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tap.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/tap.c
++++ b/drivers/net/tap.c
+@@ -1074,10 +1074,21 @@ static int tap_get_user_xdp(struct tap_q
+ skb_reset_mac_header(skb);
+ skb->protocol = eth_hdr(skb)->h_proto;
+
++ rcu_read_lock();
++ tap = rcu_dereference(q->tap);
++ if (!tap) {
++ kfree_skb(skb);
++ rcu_read_unlock();
++ return 0;
++ }
++ skb->dev = tap->dev;
++
+ if (vnet_hdr_len) {
+ err = tun_vnet_hdr_to_skb(q->flags, skb, gso);
+- if (err)
++ if (err) {
++ rcu_read_unlock();
+ goto err_kfree;
++ }
+ }
+
+ /* Move network header to the right position for VLAN tagged packets */
+@@ -1085,15 +1096,8 @@ static int tap_get_user_xdp(struct tap_q
+ vlan_get_protocol_and_depth(skb, skb->protocol, &depth) != 0)
+ skb_set_network_header(skb, depth);
+
+- rcu_read_lock();
+- tap = rcu_dereference(q->tap);
+- if (tap) {
+- skb->dev = tap->dev;
+- skb_probe_transport_header(skb);
+- dev_queue_xmit(skb);
+- } else {
+- kfree_skb(skb);
+- }
++ skb_probe_transport_header(skb);
++ dev_queue_xmit(skb);
+ rcu_read_unlock();
+
+ return 0;
--- /dev/null
+From 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 Mon Sep 17 00:00:00 2001
+From: Yi Cong <yicong@kylinos.cn>
+Date: Wed, 29 Jul 2026 11:04:36 +0800
+Subject: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yi Cong <yicong@kylinos.cn>
+
+commit 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 upstream.
+
+When the interface has NETIF_F_SG enabled and skb_linearize() fails in
+ax88179_tx_fixup(), the function returns NULL without freeing the skb.
+
+usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop
+(info->flags does not set FLAG_MULTI_PACKET for this driver), jumping
+to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`.
+Because tx_fixup() returned NULL, the local skb variable in
+usbnet_start_xmit() is NULL, so the original skb is never freed — a
+memory leak on every TX frame whose linearization fails (i.e. under
+memory pressure).
+
+Free the skb before returning, matching the error handling already used
+for the pskb_expand_head() failure path in the same function.
+
+Fixes: 16b1c4e01c89 ("net: usb: ax88179_178a: add TSO feature")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yi Cong <yicong@kylinos.cn>
+Link: https://patch.msgid.link/20260729030436.3420477-1-cong.yi@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ax88179_178a.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1487,8 +1487,10 @@ ax88179_tx_fixup(struct usbnet *dev, str
+
+ headroom = skb_headroom(skb) - 8;
+
+- if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb))
++ if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb)) {
++ dev_kfree_skb_any(skb);
+ return NULL;
++ }
+
+ if ((skb_header_cloned(skb) || headroom < 0) &&
+ pskb_expand_head(skb, headroom < 0 ? 8 : 0, 0, GFP_ATOMIC)) {
--- /dev/null
+From fde39b8a521780391fb4e5bda2c0aa4928947f12 Mon Sep 17 00:00:00 2001
+From: Doruk Tan Ozturk <doruk@0sec.ai>
+Date: Sun, 2 Aug 2026 14:06:02 +0200
+Subject: net: usb: ipheth: fix carrier_work UAF on disconnect
+
+From: Doruk Tan Ozturk <doruk@0sec.ai>
+
+commit fde39b8a521780391fb4e5bda2c0aa4928947f12 upstream.
+
+ipheth_sndbulk_callback() re-arms the carrier-check work on any
+non-zero URB status:
+
+ else
+ schedule_delayed_work(&dev->carrier_work, 0);
+
+Nothing ties that to the interface being up, so the work can be armed
+again after ipheth_close() has already drained it, and stay armed
+until the netdev whose private area embeds it is freed.
+
+On unplug with a TX URB in flight, ipheth_disconnect() drains the work
+through unregister_netdev() -> ipheth_close() ->
+cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().
+usb_kill_urb() completes the in-flight TX URB with -ENOENT, so
+ipheth_sndbulk_callback() runs after the drain and re-arms
+carrier_work.
+
+The same completion also re-arms the work if the interface is only
+brought down while a TX URB is in flight, and
+ipheth_carrier_check_work() then keeps re-queueing itself once a
+second. unregister_netdev() does not call ipheth_close() for an
+already-down interface, so nothing drains it on the later unplug
+either.
+
+In both cases free_netdev() frees the netdev while carrier_work is
+still pending, and ipheth_carrier_check_work() dereferences freed
+memory.
+
+Tie the work to the interface state instead of chasing the completion:
+disable it in ipheth_close() and enable it in ipheth_open(), so a
+schedule_delayed_work() from the URB completion is a no-op whenever
+the interface is not up. disable_delayed_work_sync() also waits for a
+running instance, so it fully replaces the cancel_delayed_work_sync()
+it takes the place of. The work starts out disabled in ipheth_probe()
+so the enable/disable counts balance from the first open.
+
+Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and
+raw-gadget standing in for the device, driving the second path above (the
+interface is already down, so unregister_netdev() does not call
+ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in
+__run_timers(), freed by ipheth_disconnect() and re-armed from
+ipheth_sndbulk_callback() via queue_delayed_work_on(). The
+same trigger on a kernel differing only by this patch reports 0 of 15,
+and the carrier check still functions across open/close cycles.
+
+The reproducer needs an attached USB device that stops draining bulk OUT,
+plus a link down and unplug, driven as root. It is not a privilege
+boundary crossing and no exploit primitive was developed.
+
+Found by 0sec (https://0sec.ai).
+
+Fixes: bb1b40c7cb86 ("usbnet: ipheth: prevent TX queue timeouts when device not ready")
+Cc: stable@vger.kernel.org
+Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
+Link: https://patch.msgid.link/20260802120602.42595-1-doruk@0sec.ai
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ipheth.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -490,6 +490,7 @@ static int ipheth_open(struct net_device
+ if (retval)
+ return retval;
+
++ enable_delayed_work(&dev->carrier_work);
+ schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+ return retval;
+ }
+@@ -499,7 +500,11 @@ static int ipheth_close(struct net_devic
+ struct ipheth_device *dev = netdev_priv(net);
+
+ netif_stop_queue(net);
+- cancel_delayed_work_sync(&dev->carrier_work);
++ /* A TX URB can still complete with an error after this point and
++ * try to re-arm the carrier work. Disable it instead of cancelling
++ * it, so that such a schedule_delayed_work() is a no-op.
++ */
++ disable_delayed_work_sync(&dev->carrier_work);
+ return 0;
+ }
+
+@@ -629,6 +634,10 @@ static int ipheth_probe(struct usb_inter
+ }
+
+ INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
++ /* Armed only between ipheth_open() and ipheth_close(). Start out
++ * disabled so the enable/disable counts balance from the first open.
++ */
++ disable_delayed_work(&dev->carrier_work);
+
+ retval = ipheth_alloc_urbs(dev);
+ if (retval) {
hwmon-support-guard-and-scoped_guard-for-subsystem-l.patch
hwmon-corsair-psu-serialize-debugfs-access-against-h.patch
alsa-usb-audio-fix-sticky-mixer-regressions-on-m-aud.patch
+net-tap-set-skb-dev-before-parsing-virtio-net-header-in-tap_get_user_xdp.patch
+input-evdev-sanitize-event-type-index-when-fetching-event-masks.patch
+alsa-usb-audio-fix-oob-write-on-type-ii-inbound-urbs.patch
+usb-core-add-quirk-for-255-bytes-initial-config-read.patch
+usb-quirks-add-shanwan-gamepad-to-quirk-list.patch
+usb-misc-usbio-check-ibuf_len-against-rxbuf_len-in-bulk-msg.patch
+usb-atm-cxacru-properly-kill-rcv_urb-on-error-in-cxacru_cm.patch
+usb-xhci-use-bit_ull-for-crcr-bits-to-fix-incorrect-64bit-mask.patch
+thunderbolt-icm-preserve-usb4-proxy-data-valid-bit.patch
+usb-cdnsp-fix-incorrect-endian-conversions-for-apb-timeout-register.patch
+usb-gadget-f_ncm-use-unsigned-int-for-ndp_index.patch
+net-usb-ax88179_178a-fix-skb-leak-in-ax88179_tx_fixup.patch
+net-usb-ipheth-fix-carrier_work-uaf-on-disconnect.patch
+usbnet-cap-max_mtu-for-drivers-without-bind-callback.patch
+vt-add-permission-check-for-kdskbmeta-ioctl.patch
+vt-stabilize-tty-reference-in-kbd_keycode-with-tty_port_tty_get.patch
--- /dev/null
+From e48844ece5e3ed1d1eb865f6da2b16f62cd9f86d Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Mon, 13 Jul 2026 17:32:37 +0800
+Subject: thunderbolt: icm: Preserve USB4 proxy data-valid bit
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit e48844ece5e3ed1d1eb865f6da2b16f62cd9f86d upstream.
+
+The ICM USB4 switch operation request encodes two values in
+request.data_len_valid: bit 4 marks the data payload valid, while bits
+3:0 hold the payload length in dwords. A zero length with the valid bit
+set represents the full 16-dword data array.
+
+icm_usb4_switch_op() sets the valid bit when a transmit payload is
+present. For payloads shorter than the full 16 dwords, it then assigns
+the length to the whole field and clears the valid bit that was just set.
+The payload is still copied into the request, but the descriptor sent to
+firmware marks that data as invalid.
+
+This affects USB4 router operations that send short payloads through the
+firmware connection manager. In particular, USB4 NVM writes can send a
+short final block when the image size is not aligned to the 64-byte proxy
+payload size. Firmware may then ignore or reject that final block, while
+full 16-dword blocks are unaffected because they are encoded as length 0
+with the valid bit set.
+
+OR the short payload length into data_len_valid so the valid bit is
+preserved.
+
+Fixes: 9039387e166e ("thunderbolt: Add USB4 router operation proxy for firmware connection manager")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/icm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thunderbolt/icm.c
++++ b/drivers/thunderbolt/icm.c
+@@ -2325,7 +2325,7 @@ static int icm_usb4_switch_op(struct tb_
+ if (tx_data_len) {
+ request.data_len_valid |= ICM_USB4_SWITCH_DATA_VALID;
+ if (tx_data_len < ARRAY_SIZE(request.data))
+- request.data_len_valid =
++ request.data_len_valid |=
+ tx_data_len & ICM_USB4_SWITCH_DATA_LEN_MASK;
+ memcpy(request.data, tx_data, tx_data_len * sizeof(u32));
+ }
--- /dev/null
+From c2f811314be351d86b6ab41e9297ae80d8da6f86 Mon Sep 17 00:00:00 2001
+From: Aleksandr Nogikh <nogikh@google.com>
+Date: Fri, 31 Jul 2026 10:15:20 +0000
+Subject: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
+
+From: Aleksandr Nogikh <nogikh@google.com>
+
+commit c2f811314be351d86b6ab41e9297ae80d8da6f86 upstream.
+
+If cxacru_cm() encounters an error while submitting or waiting for snd_urb,
+it aborts and returns the error without killing the already submitted
+rcv_urb. This leaves the rcv_urb active.
+
+When this happens during initialization (e.g., in cxacru_atm_start()), the
+driver may ignore the error and proceed to call cxacru_poll_status(), which
+invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb
+triggers a warning in usb_submit_urb():
+
+cxacru 1-1:1.0: send of cm 0x84 failed (-104)
+ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104
+------------[ cut here ]------------
+URB ffff88812658d200 submitted while active
+WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0
+drivers/usb/core/urb.c:379
+...
+Call Trace:
+ <TASK>
+ cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631
+ cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline]
+ cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828
+ cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814
+ usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927
+ usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178
+ cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370
+...
+
+To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts
+early. We can safely call usb_kill_urb() on rcv_urb in the error path, as
+it is safe to call even if the URB is not active (e.g., if it failed to
+submit in the first place, or if it already completed).
+
+Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru")
+Cc: stable <stable@kernel.org>
+Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
+Reported-by: syzbot+c9dff578c3a41775176a@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=c9dff578c3a41775176a
+Link: https://syzkaller.appspot.com/ai_job?id=75fec6f2-c8a6-43b1-b184-4d26baba86cc
+Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
+Link: https://patch.msgid.link/91edfa4c-a63d-400c-9f00-31f3e1f98c00@mail.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/atm/cxacru.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -700,6 +700,8 @@ static int cxacru_cm(struct cxacru_data
+ ret = offd;
+ usb_dbg(instance->usbatm, "cm %#x\n", cm);
+ fail:
++ if (ret < 0)
++ usb_kill_urb(instance->rcv_urb);
+ mutex_unlock(&instance->cm_serialize);
+ err:
+ return ret;
--- /dev/null
+From 50b303f3d0f7de543ee90d50879970783d06da33 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Mon, 20 Jul 2026 13:11:58 +0200
+Subject: usb: cdnsp: fix incorrect endian conversions for APB timeout register
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit 50b303f3d0f7de543ee90d50879970783d06da33 upstream.
+
+readl() already returns a CPU-endian value. Passing its return value to
+le32_to_cpu() is therefore redundant and causes an incorrect double byte
+swap on big-endian systems.
+
+Similarly, writel() expects a CPU-endian value, so passing the result of
+cpu_to_le32() is incorrect.
+
+Remove the unnecessary conversions and operate on the MMIO register value
+as a CPU-endian u32.
+
+Fixes: 241e2ce88e5a ("usb: cdnsp: Fix issue with resuming from L1")
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260720-endian-fix-v1-v1-1-b5681fa1ea9f@cadence.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -155,9 +155,9 @@ static void cdnsp_set_apb_timeout_value(
+ offset = cdnsp_find_next_ext_cap(base, offset, D_XEC_PRE_REGS_CAP);
+ reg = base + offset + REG_CHICKEN_BITS_3_OFFSET;
+
+- val = le32_to_cpu(readl(reg));
++ val = readl(reg);
+ val = CHICKEN_APB_TIMEOUT_SET(val, cdns->override_apb_timeout);
+- writel(cpu_to_le32(val), reg);
++ writel(val, reg);
+ }
+
+ static void cdnsp_set_chicken_bits_2(struct cdnsp_device *pdev, u32 bit)
--- /dev/null
+From 152f174a13618bec1f842d2deb69245cb2ace51f Mon Sep 17 00:00:00 2001
+From: Nikhil Solanke <nikhilsolanke5@gmail.com>
+Date: Wed, 29 Jul 2026 01:21:57 +0530
+Subject: usb: core: Add quirk for 255-bytes initial config read
+
+From: Nikhil Solanke <nikhilsolanke5@gmail.com>
+
+commit 152f174a13618bec1f842d2deb69245cb2ace51f upstream.
+
+Certain third-party USB game controllers exposing (or spoofing) an Xbox
+360-compatible interface (VID:PID 045e:028e) fail to enumerate under Linux.
+The device disconnects from the bus without responding to the initial
+GET_DESCRIPTOR(CONFIGURATION) request, and the kernel logs 'unable to read
+config index 0 descriptor/start: -71'.
+
+The device then falls back to a secondary Android HID mode (with a
+different VID:PID), losing XInput functionality including rumble support.
+The failure reproduces across multiple machines, host controller types, and
+kernel versions including current mainline and LTS. The device enumerates
+correctly and remains in XInput mode under Windows. Notably, the device
+enumerates correctly in Android mode when the same 9-byte request
+is issued for that mode's configuration descriptor, confirming the firmware
+bug is specific to the XInput mode.
+
+usbmon traces from Linux and Wireshark/USBPcap traces from Windows are
+identical up to the point of failure, with no visible protocol-level
+difference explaining the divergence. The root cause was identified when
+Michal Pecio discovered via a QEMU bus-level capture that Windows does not
+use wLength=9 for the initial config descriptor request; it uses
+wLength=255. Alan Stern subsequently confirmed this with a bus
+analyzer on a different USB 2.0 device, and Michal verified the behavior
+goes back to Windows 95 OSR2.1.
+
+So, add a new quirk flag USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE which causes
+usb_get_configuration() to issue a 255 byte sized configuration request
+instead of USB_DT_CONFIG_SIZE (9) for the initial
+GET_DESCRIPTOR(CONFIGURATION) request, mimicking long-standing Windows
+behavior.
+
+This patch intentionally does not add any new VID:PID entries using this
+quirk. Some affected Xbox 360-compatible controllers spoof Microsoft's
+VID:PID, while genuine Microsoft controllers already enumerate correctly
+and do not require this quirk. Other affected clone devices use their own
+VID:PID pairs and can be added individually as they are identified.
+
+Suggested-by: Alan Stern <stern@rowland.harvard.edu>
+Suggested-by: Michal Pecio <michal.pecio@gmail.com>
+Closes: https://lore.kernel.org/linux-usb/CAFgddh+JWdT4LLwMc5qjM8q_pBu-fRo2qADR5ovAKoGHWMQrRw@mail.gmail.com/
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@kernel.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Nikhil Solanke <nikhilsolanke5@gmail.com>
+Link: https://patch.msgid.link/20260728195158.65162-2-nikhilsolanke5@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 5 +++
+ drivers/usb/core/config.c | 32 ++++++++++++++++++------
+ drivers/usb/core/quirks.c | 4 +++
+ include/linux/usb/quirks.h | 3 ++
+ 4 files changed, 36 insertions(+), 8 deletions(-)
+
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -8158,6 +8158,11 @@ Kernel parameters
+ q = USB_QUIRK_FORCE_ONE_CONFIG (Device
+ claims zero configurations,
+ forcing to 1);
++ r = USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE (Device
++ fails during initialization when asked for
++ 9-bytes configuration descriptor request.
++ Ask for 255-bytes request instead to mirror
++ Windows' behavior);
+ Example: quirks=0781:5580:bk,0a5c:5834:gij
+
+ usbhid.mousepoll=
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -912,6 +912,18 @@ int usb_get_configuration(struct usb_dev
+ unsigned char *bigbuffer;
+ struct usb_config_descriptor *desc;
+ int result;
++ size_t usb_config_req_size;
++
++ /*
++ * We usually start by grabbing the first 9-bytes descriptor so we know
++ * how long the whole configuration is. Some devices with quirky
++ * firmware will fail enumeration, so if the quirk is set, use 255 instead,
++ * mirroring the behavior of Windows.
++ */
++ if (dev->quirks & USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE)
++ usb_config_req_size = 255;
++ else
++ usb_config_req_size = USB_DT_CONFIG_SIZE;
+
+ if (ncfg > USB_MAXCONFIG) {
+ dev_notice(ddev, "too many configurations: %d, "
+@@ -938,15 +950,13 @@ int usb_get_configuration(struct usb_dev
+ if (!dev->rawdescriptors)
+ return -ENOMEM;
+
+- desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL);
++ desc = kmalloc(usb_config_req_size, GFP_KERNEL);
+ if (!desc)
+ return -ENOMEM;
+
+ for (cfgno = 0; cfgno < ncfg; cfgno++) {
+- /* We grab just the first descriptor so we know how long
+- * the whole configuration is */
+ result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
+- desc, USB_DT_CONFIG_SIZE);
++ desc, usb_config_req_size);
+ if (result < 0) {
+ dev_err(ddev, "unable to read config index %d "
+ "descriptor/%s: %d\n", cfgno, "start", result);
+@@ -956,16 +966,14 @@ int usb_get_configuration(struct usb_dev
+ dev->descriptor.bNumConfigurations = cfgno;
+ break;
+ } else if (result < 4) {
+- dev_err(ddev, "config index %d descriptor too short "
+- "(expected %i, got %i)\n", cfgno,
+- USB_DT_CONFIG_SIZE, result);
++ dev_err(ddev, "config index %d descriptor too short (asked for %zu, got %i)\n",
++ cfgno, usb_config_req_size, result);
+ result = -EINVAL;
+ goto err;
+ }
+ length = max_t(int, le16_to_cpu(desc->wTotalLength),
+ USB_DT_CONFIG_SIZE);
+
+- /* Now that we know the length, get the whole thing */
+ bigbuffer = kmalloc(length, GFP_KERNEL);
+ if (!bigbuffer) {
+ result = -ENOMEM;
+@@ -975,6 +983,13 @@ int usb_get_configuration(struct usb_dev
+ if (dev->quirks & USB_QUIRK_DELAY_INIT)
+ msleep(200);
+
++ /* Skip the second read if we already got everything */
++ if (result >= length) {
++ memcpy(bigbuffer, desc, length);
++ goto store_and_parse;
++ }
++
++ /* Get the whole thing */
+ result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
+ bigbuffer, length);
+ if (result < 0) {
+@@ -989,6 +1004,7 @@ int usb_get_configuration(struct usb_dev
+ length = result;
+ }
+
++store_and_parse:
+ dev->rawdescriptors[cfgno] = bigbuffer;
+
+ result = usb_parse_configuration(dev, cfgno,
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -142,6 +142,10 @@ static int quirks_param_set(const char *
+ break;
+ case 'q':
+ flags |= USB_QUIRK_FORCE_ONE_CONFIG;
++ break;
++ case 'r':
++ flags |= USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE;
++ break;
+ /* Ignore unrecognized flag characters */
+ }
+ }
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -81,4 +81,7 @@
+ /* Device claims zero configurations, forcing to 1 */
+ #define USB_QUIRK_FORCE_ONE_CONFIG BIT(18)
+
++/* Use a 255 bytes config descriptor request mirroring windows behavior */
++#define USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE BIT(19)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
--- /dev/null
+From 6b1c8a9403a26cb0fed7a648916c74dc236da591 Mon Sep 17 00:00:00 2001
+From: Sonali Pradhan <sonalipradhan@google.com>
+Date: Mon, 20 Jul 2026 16:56:54 +0000
+Subject: usb: gadget: f_ncm: Use unsigned int for ndp_index
+
+From: Sonali Pradhan <sonalipradhan@google.com>
+
+commit 6b1c8a9403a26cb0fed7a648916c74dc236da591 upstream.
+
+The variable ndp_index is declared as a signed integer, but it stores
+the return value of get_ncm(), which is unsigned.
+
+A malicious host can supply a large offset that overflows the signed
+ndp_index, making it negative. Because ndp_index is compared against
+unsigned bounds, this negative value bypasses sanity checks and leads
+to an out-of-bounds read when calculating the address of the NDP
+block (ntb_ptr + ndp_index).
+
+Fix this by changing ndp_index to unsigned int to ensure consistent
+unsigned comparisons throughout the function.
+
+Fixes: 370af734dfaf ("usb: gadget: NCM: RX function support multiple NDPs")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
+Link: https://patch.msgid.link/20260720165654.2224591-1-sonalipradhan@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1171,7 +1171,7 @@ static int ncm_unwrap_ntb(struct gether
+ unsigned char *ntb_ptr = skb->data;
+ __le16 *tmp;
+ unsigned index, index2;
+- int ndp_index;
++ unsigned int ndp_index;
+ unsigned dg_len, dg_len2;
+ unsigned ndp_len;
+ unsigned block_len;
--- /dev/null
+From 7e22c9f79b200672f3e477421b6c9050d8cf70a5 Mon Sep 17 00:00:00 2001
+From: Jiangshan Yi <yijiangshan@kylinos.cn>
+Date: Wed, 22 Jul 2026 18:18:10 +0800
+Subject: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiangshan Yi <yijiangshan@kylinos.cn>
+
+commit 7e22c9f79b200672f3e477421b6c9050d8cf70a5 upstream.
+
+ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
+in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
+endpoint size. Both are taken independently from different endpoints
+in usbio_probe(), so the check is wrong when they differ.
+
+Use rxbuf_len for the IN direction. This matches the buffer that
+actually holds the response data.
+
+Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
+Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
+Link: https://patch.msgid.link/20260722101810.458634-1-yijiangshan@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/usbio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/usbio.c
++++ b/drivers/usb/misc/usbio.c
+@@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_devi
+ lockdep_assert_held(&usbio->bulk_mutex);
+
+ if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
+- (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
++ (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
+ return -EMSGSIZE;
+
+ if (ibuf_len)
--- /dev/null
+From f3988e68fc089f6a5883f4f807955a3825bb7d45 Mon Sep 17 00:00:00 2001
+From: Ishaan Dandekar <ishaan.dandekar@gmail.com>
+Date: Sun, 2 Aug 2026 17:31:29 +0530
+Subject: usb: quirks: Add ShanWan gamepad to quirk list
+
+From: Ishaan Dandekar <ishaan.dandekar@gmail.com>
+
+commit f3988e68fc089f6a5883f4f807955a3825bb7d45 upstream.
+
+The ShanWan Wireless Gamepad (dongle ID 2563:0575) crashes with a -71
+EPROTO error during standard enumeration because it expects a 255-byte
+initial configuration request. Add this device to the quirk list to
+use the USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE flag.
+
+Signed-off-by: Ishaan Dandekar <ishaan.dandekar@gmail.com>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20260802120128.38302-1-ishaan.dandekar@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -593,6 +593,9 @@ static const struct usb_device_id usb_qu
+
+ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* ShanWan Wireless Gamepad */
++ { USB_DEVICE(0x2563, 0x0575), .driver_info = USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE },
++
+ /* UGREEN 35871 - BOS descriptor fetch hangs at SuperSpeed Plus */
+ { USB_DEVICE(0x2b89, 0x5871), .driver_info = USB_QUIRK_NO_BOS },
+
--- /dev/null
+From 3d26cd1f3ff25cebd10d4b0e8188cf40dade28e9 Mon Sep 17 00:00:00 2001
+From: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+Date: Tue, 4 Aug 2026 11:36:39 +0300
+Subject: usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
+
+From: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+
+commit 3d26cd1f3ff25cebd10d4b0e8188cf40dade28e9 upstream.
+
+xhci is unusable on some systems after driver switched to BIT() macro.
+Upper 32bits of 64bit CRCR command register are unintentionally cleared.
+
+Seen on a raspberry pi 4B compiled for arm32.
+The main symptoms were the following log message:
+
+[ 0.549897] raspberrypi-firmware soc:firmware: Attached to firmware from 2021-02-25T12:11:39
+[ 0.626859] xhci_hcd 0000:01:00.0: xHCI Host Controller
+[ 0.626889] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 1
+[ 0.812619] xhci_hcd 0000:01:00.0: hcc params 0x002841eb hci version 0x100 quirks 0x0000200000000890
+[ 0.813188] xhci_hcd 0000:01:00.0: xHCI Host Controller
+[ 0.813203] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 2
+[ 0.813219] xhci_hcd 0000:01:00.0: Host supports USB 3.0 SuperSpeed
+[ 0.813602] hub 1-0:1.0: USB hub found
+[ 0.814052] hub 2-0:1.0: USB hub found
+[ 0.952714] xhci_hcd 0000:01:00.0: ERROR mismatched command completion event
+
+Additionally running lsusb just hangs. Running the same kernel compiled
+for aarch64 worked fine. Bisected to the commit in the Fixes line.
+Additionally a USB device plugged in to the USB3.0 (or 2.0) did not
+enumerate. Once this patch is applied the USB device enumerates properly.
+
+The CRCR register is 64 bits wide - commit abe93f27cdd7
+("xhci: use BIT macro") changed the flag definitions from (1 << n),
+a signed int, to BIT(n), an unsigned long. Within
+xhci_set_cmd_ring_deq(), the following operation is performed on the
+CRCR register:
+
+...
+ crcr &= ~CMD_RING_PTR_MASK;
+ crcr |= deq_dma;
+ crcr &= ~CMD_RING_CYCLE;
+ crcr |= xhci->cmd_ring->cycle_state;
+...
+
+Previously, ~CMD_RING_CYCLE was ~(int)1, a negative signed value
+(0xFFFFFFFE with the sign bit set). Widening a negative signed int to
+u64 sign-extends it to 0xFFFFFFFFFFFFFFFE, correctly clearing only bit
+0 and preserving the 64-bit pointer written two lines above.
+
+After the change when running on 32 bit kernels, ~CMD_RING_CYCLE is
+~(unsigned long)1UL. On a 32-bit host this is an unsigned 32-bit
+value (0xFFFFFFFE, no sign bit). Widening an unsigned value to u64
+zero-extends it instead (0x00000000FFFFFFFE), so the subsequent AND
+silently clears bits 63:32 of crcr, truncating the command ring
+pointer that was just written before the value reaches hardware.
+
+To fix, similar to how CMD_RING_PTR_MASK is defined, make sure we
+use the BIT_ULL variant when defining the CRCR bits.
+
+[Mathias: use BIT_ULL() for ERST_EHB and EP_CTX_CYCLE_MASK as suggested
+by Michal Pecio, also include raspberry case in commit message]
+
+Fixes: abe93f27cdd7 ("xhci: use BIT macro")
+Cc: stable <stable@kernel.org>
+Assisted-by: Claude:claude-sonnet-5
+cc: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20260804083639.2148950-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -187,13 +187,13 @@ struct xhci_op_regs {
+
+ /* CRCR - Command Ring Control Register - cmd_ring bitmasks */
+ /* bit 0 - Cycle bit indicates the ownership of the command ring */
+-#define CMD_RING_CYCLE BIT(0)
++#define CMD_RING_CYCLE BIT_ULL(0)
+ /* stop ring operation after completion of the currently executing command */
+-#define CMD_RING_PAUSE BIT(1)
++#define CMD_RING_PAUSE BIT_ULL(1)
+ /* stop ring immediately - abort the currently executing command */
+-#define CMD_RING_ABORT BIT(2)
++#define CMD_RING_ABORT BIT_ULL(2)
+ /* true: command ring is running */
+-#define CMD_RING_RUNNING BIT(3)
++#define CMD_RING_RUNNING BIT_ULL(3)
+ /* bits 63:6 - Command Ring pointer */
+ #define CMD_RING_PTR_MASK GENMASK_ULL(63, 6)
+
+@@ -268,7 +268,7 @@ struct xhci_intr_reg {
+ * bit 3 - Event Handler Busy (EHB), whether the event ring is scheduled to be serviced by
+ * a work queue (or delayed service routine)?
+ */
+-#define ERST_EHB BIT(3)
++#define ERST_EHB BIT_ULL(3)
+ /* bits 63:4 - Event Ring Dequeue Pointer */
+ #define ERST_PTR_MASK GENMASK_ULL(63, 4)
+
+@@ -499,7 +499,7 @@ struct xhci_ep_ctx {
+ #define CTX_TO_MAX_ESIT_PAYLOAD(p) (((p) >> 16) & 0xffff)
+
+ /* deq bitmasks */
+-#define EP_CTX_CYCLE_MASK BIT(0)
++#define EP_CTX_CYCLE_MASK BIT_ULL(0)
+ /* bits 63:4 - TR Dequeue Pointer */
+ #define TR_DEQ_PTR_MASK GENMASK_ULL(63, 4)
+
--- /dev/null
+From 1505b2cb6ae1c7e8ac0c6e4590a204ffc3ab2b24 Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Fri, 31 Jul 2026 11:27:11 +0200
+Subject: usbnet: cap max_mtu for drivers without bind callback
+
+From: Laurent Vivier <lvivier@redhat.com>
+
+commit 1505b2cb6ae1c7e8ac0c6e4590a204ffc3ab2b24 upstream.
+
+usbnet_probe() initializes max_mtu to ETH_MAX_MTU and only caps it
+inside the if (info->bind) block. Drivers without a bind callback
+never enter this block, so max_mtu stays at ETH_MAX_MTU.
+
+QEMU's usb-net device (0x0525/0xa4a2) is claimed by the cdc_subset
+driver which has no bind callback. The guest accepts any MTU from DHCP
+(e.g. 65520 from passt), leading to TCP segments that exceed the
+device's 2048-byte receive buffer and are silently dropped.
+
+Initialize max_mtu to net->mtu at probe time and update it inside
+the bind block.
+
+Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers")
+Cc: jarod@redhat.com
+Cc: stable@vger.kernel.org
+Link: https://gitlab.com/qemu-project/qemu/-/issues/3268
+Link: https://bugs.passt.top/show_bug.cgi?id=189
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Link: https://patch.msgid.link/20260731092711.857684-1-lvivier@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/usbnet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1798,7 +1798,7 @@ usbnet_probe(struct usb_interface *udev,
+ */
+ dev->hard_mtu = net->mtu + net->hard_header_len;
+ net->min_mtu = 0;
+- net->max_mtu = ETH_MAX_MTU;
++ net->max_mtu = net->mtu;
+
+ net->netdev_ops = &usbnet_netdev_ops;
+ net->watchdog_timeo = TX_TIMEOUT_JIFFIES;
+@@ -1808,6 +1808,7 @@ usbnet_probe(struct usb_interface *udev,
+ // allow device-specific bind/init procedures
+ // NOTE net->name still not usable ...
+ if (info->bind) {
++ net->max_mtu = ETH_MAX_MTU;
+ status = info->bind(dev, udev);
+ if (status < 0)
+ goto out1;
--- /dev/null
+From a7ad0034453ba4c353f9b8f810ee2569de33d283 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <linux@joshua.hu>
+Date: Fri, 31 Jul 2026 09:56:17 +0200
+Subject: vt: add permission check for KDSKBMETA ioctl
+
+From: Joshua Rogers <linux@joshua.hu>
+
+commit a7ad0034453ba4c353f9b8f810ee2569de33d283 upstream.
+
+KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all
+other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process
+to change meta mode on a non-controlling console without authorization.
+
+Assisted-by: AISLE:Snapshot
+Cc: stable <stable@kernel.org>
+Signed-off-by: Joshua Rogers <linux@joshua.hu>
+Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-2-be99b9da8e30@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/vt_ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -406,6 +406,8 @@ static int vt_k_ioctl(struct tty_struct
+ /* this could be folded into KDSKBMODE, but for compatibility
+ reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
+ case KDSKBMETA:
++ if (!perm)
++ return -EPERM;
+ return vt_do_kdskbmeta(console, arg);
+
+ case KDGKBMETA:
--- /dev/null
+From e25d47a526939ad44b75f778b8a7500562b84fc1 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <linux@joshua.hu>
+Date: Fri, 31 Jul 2026 09:56:16 +0200
+Subject: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
+
+From: Joshua Rogers <linux@joshua.hu>
+
+commit e25d47a526939ad44b75f778b8a7500562b84fc1 upstream.
+
+kbd_keycode() reads vc->port.tty without acquiring a tty reference,
+racing against con_shutdown() which clears port.tty under a different
+lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference
+for the duration the tty pointer is needed.
+
+Assisted-by: AISLE:Snapshot
+Signed-off-by: Joshua Rogers <linux@joshua.hu>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-1-be99b9da8e30@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/keyboard.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1437,7 +1437,7 @@ static void kbd_keycode(unsigned int key
+ struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
+ int rc;
+
+- tty = vc->port.tty;
++ tty = tty_port_tty_get(&vc->port);
+
+ if (tty && (!tty->driver_data)) {
+ /* No driver data? Strange. Okay we fix it then. */
+@@ -1497,9 +1497,12 @@ static void kbd_keycode(unsigned int key
+ * characters get aren't echoed locally. This makes key repeat
+ * usable with slow applications and under heavy loads.
+ */
++ tty_kref_put(tty);
+ return;
+ }
+
++ tty_kref_put(tty);
++
+ param.shift = shift_final = (shift_state | kbd->slockstate) ^ kbd->lockstate;
+ param.ledstate = kbd->ledflagstate;
+ key_map = key_maps[shift_final];
projects / thirdparty / kernel / stable-queue.git / commitdiff
