--- /dev/null
+From 5cefb52c1af6f69ea719e42788f6ec6a087eb74c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Mar 2026 11:51:27 +0100
+Subject: gpib: lpvo_usb: fix memory leak on disconnect
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 5cefb52c1af6f69ea719e42788f6ec6a087eb74c upstream.
+
+The driver iterates over the registered USB interfaces during GPIB
+attach and takes a reference to their USB devices until a match is
+found. These references are never released which leads to a memory leak
+when devices are disconnected.
+
+Fix the leak by dropping the unnecessary references.
+
+Fixes: fce79512a96a ("staging: gpib: Add LPVO DIY USB GPIB driver")
+Cc: stable <stable@kernel.org> # 6.13
+Cc: Dave Penkler <dpenkler@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260310105127.17538-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c
++++ b/drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c
+@@ -406,7 +406,7 @@ static int usb_gpib_attach(struct gpib_b
+ for (j = 0 ; j < MAX_DEV ; j++) {
+ if ((assigned_usb_minors & 1 << j) == 0)
+ continue;
+- udev = usb_get_dev(interface_to_usbdev(lpvo_usb_interfaces[j]));
++ udev = interface_to_usbdev(lpvo_usb_interfaces[j]);
+ device_path = kobject_get_path(&udev->dev.kobj, GFP_KERNEL);
+ match = gpib_match_device_path(&lpvo_usb_interfaces[j]->dev,
+ config->device_path);
+@@ -421,7 +421,7 @@ static int usb_gpib_attach(struct gpib_b
+ for (j = 0 ; j < MAX_DEV ; j++) {
+ if ((assigned_usb_minors & 1 << j) == 0)
+ continue;
+- udev = usb_get_dev(interface_to_usbdev(lpvo_usb_interfaces[j]));
++ udev = interface_to_usbdev(lpvo_usb_interfaces[j]);
+ DIA_LOG(1, "dev. %d: bus %d -> %d dev: %d -> %d\n", j,
+ udev->bus->busnum, config->pci_bus, udev->devnum, config->pci_slot);
+ if (config->pci_bus == udev->bus->busnum &&
--- /dev/null
+From 9d3fa23d5d55a137fd4396d3d4799102587a7f2b Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Thu, 12 Mar 2026 13:20:23 +0200
+Subject: iio: accel: adxl313: add missing error check in predisable
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit 9d3fa23d5d55a137fd4396d3d4799102587a7f2b upstream.
+
+Check the return value of the FIFO bypass regmap_write() before
+proceeding to disable interrupts.
+
+Fixes: ff8093fa6ba4 ("iio: accel: adxl313: add buffered FIFO watermark with interrupt handling")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/adxl313_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/accel/adxl313_core.c
++++ b/drivers/iio/accel/adxl313_core.c
+@@ -998,6 +998,8 @@ static int adxl313_buffer_predisable(str
+
+ ret = regmap_write(data->regmap, ADXL313_REG_FIFO_CTL,
+ FIELD_PREP(ADXL313_REG_FIFO_CTL_MODE_MSK, ADXL313_FIFO_BYPASS));
++ if (ret)
++ return ret;
+
+ ret = regmap_write(data->regmap, ADXL313_REG_INT_ENABLE, 0);
+ if (ret)
--- /dev/null
+From bd66aa1c8b8cabf459064a46d3430a5ec5138418 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Fri, 27 Feb 2026 14:43:05 +0200
+Subject: iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit bd66aa1c8b8cabf459064a46d3430a5ec5138418 upstream.
+
+FIELD_PREP(BIT(0), fifo_samples & BIT(8)) produces either 0 or 256,
+and since FIELD_PREP masks to bit 0, 256 & 1 evaluates to 0. Use !!
+to convert the result to a proper 0-or-1 value.
+
+Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/adxl380.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/adxl380.c
++++ b/drivers/iio/accel/adxl380.c
+@@ -860,7 +860,7 @@ static int adxl380_set_fifo_samples(stru
+ ret = regmap_update_bits(st->regmap, ADXL380_FIFO_CONFIG_0_REG,
+ ADXL380_FIFO_SAMPLES_8_MSK,
+ FIELD_PREP(ADXL380_FIFO_SAMPLES_8_MSK,
+- (fifo_samples & BIT(8))));
++ !!(fifo_samples & BIT(8))));
+ if (ret)
+ return ret;
+
--- /dev/null
+From 4f51e6c0baae80e52bd013092e82a55678be31fc Mon Sep 17 00:00:00 2001
+From: Valek Andrej <andrej.v@skyrain.eu>
+Date: Fri, 13 Mar 2026 10:24:13 +0100
+Subject: iio: accel: fix ADXL355 temperature signature value
+
+From: Valek Andrej <andrej.v@skyrain.eu>
+
+commit 4f51e6c0baae80e52bd013092e82a55678be31fc upstream.
+
+Temperature was wrongly represented as 12-bit signed, confirmed by checking
+the datasheet. Even if the temperature is negative, the value in the
+register stays unsigned.
+
+Fixes: 12ed27863ea3 iio: accel: Add driver support for ADXL355
+Signed-off-by: Valek Andrej <andrej.v@skyrain.eu>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/adxl355_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/adxl355_core.c
++++ b/drivers/iio/accel/adxl355_core.c
+@@ -745,7 +745,7 @@ static const struct iio_chan_spec adxl35
+ BIT(IIO_CHAN_INFO_OFFSET),
+ .scan_index = 3,
+ .scan_type = {
+- .sign = 's',
++ .sign = 'u',
+ .realbits = 12,
+ .storagebits = 16,
+ .endianness = IIO_BE,
--- /dev/null
+From 86133fb1ec36b2f5cec29d71fbae84877c3a1358 Mon Sep 17 00:00:00 2001
+From: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
+Date: Thu, 26 Feb 2026 18:07:02 +0400
+Subject: iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power
+
+From: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
+
+commit 86133fb1ec36b2f5cec29d71fbae84877c3a1358 upstream.
+
+The switch statement in ade9000_write_raw() attempts to match
+chan->address against ADE9000_REG_AWATTOS (0x00F) to dispatch
+the calibration offset write for active power channels. However,
+chan->address is set via ADE9000_ADDR_ADJUST(ADE9000_REG_AWATT,
+num), so after masking the phase bits, tmp holds
+ADE9000_REG_AWATT (0x210), which never matches 0x00F.
+
+As a result, writing IIO_CHAN_INFO_CALIBBIAS for IIO_POWER always
+falls through to the default case and returns -EINVAL, making
+active power offset calibration silently broken.
+
+Fix this by matching against ADE9000_REG_AWATT instead, which is
+the actual base address stored in chan->address for watt channels.
+
+Reference:ADE9000 datasheet (Rev. B), AWATTOS is the offset correction
+register at 0x00F (p. 44), while AWATT is the total active power
+register at 0x210 (p. 48).
+
+Fixes: 81de7b4619fc ("iio: adc: add ade9000 support")
+Signed-off-by: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
+Reviewed-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ade9000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ade9000.c
++++ b/drivers/iio/adc/ade9000.c
+@@ -1123,7 +1123,7 @@ static int ade9000_write_raw(struct iio_
+ tmp &= ~ADE9000_PHASE_C_POS_BIT;
+
+ switch (tmp) {
+- case ADE9000_REG_AWATTOS:
++ case ADE9000_REG_AWATT:
+ return regmap_write(st->regmap,
+ ADE9000_ADDR_ADJUST(ADE9000_REG_AWATTOS,
+ chan->channel), val);
--- /dev/null
+From 57b207e38d414a27fda9fff638a0d3e7ef16b917 Mon Sep 17 00:00:00 2001
+From: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
+Date: Tue, 24 Feb 2026 17:23:55 +0400
+Subject: iio: adc: ade9000: fix wrong return type in streaming push
+
+From: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
+
+commit 57b207e38d414a27fda9fff638a0d3e7ef16b917 upstream.
+
+The else branch of ade9000_iio_push_streaming() incorrectly returns
+IRQ_HANDLED on regmap_write failure. This function returns int (0 on
+success, negative errno on failure), so IRQ_HANDLED (1) would be
+misinterpreted as a non-error by callers.
+
+Return ret instead, consistent with every other error path in the
+function.
+
+Fixes: 81de7b4619fc ("iio: adc: add ade9000 support")
+Signed-off-by: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com>
+Reviewed-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ade9000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ade9000.c
++++ b/drivers/iio/adc/ade9000.c
+@@ -787,7 +787,7 @@ static int ade9000_iio_push_streaming(st
+ ADE9000_MIDDLE_PAGE_BIT);
+ if (ret) {
+ dev_err_ratelimited(dev, "IRQ0 WFB write fail");
+- return IRQ_HANDLED;
++ return ret;
+ }
+
+ ade9000_configure_scan(indio_dev, ADE9000_REG_WF_BUFF);
--- /dev/null
+From 0206dd36418c104c0b3dea4ed7047e21eccb30b0 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Fri, 27 Feb 2026 15:33:30 +0200
+Subject: iio: adc: ade9000: move mutex init before IRQ registration
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit 0206dd36418c104c0b3dea4ed7047e21eccb30b0 upstream.
+
+Move devm_mutex_init() before ade9000_request_irq() calls so that
+st->lock is initialized before any handler that depends on it can run.
+
+Fixes: 81de7b4619fc ("iio: adc: add ade9000 support")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ade9000.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/adc/ade9000.c
++++ b/drivers/iio/adc/ade9000.c
+@@ -1706,19 +1706,19 @@ static int ade9000_probe(struct spi_devi
+
+ init_completion(&st->reset_completion);
+
+- ret = ade9000_request_irq(dev, "irq0", ade9000_irq0_thread, indio_dev);
++ ret = devm_mutex_init(dev, &st->lock);
+ if (ret)
+ return ret;
+
+- ret = ade9000_request_irq(dev, "irq1", ade9000_irq1_thread, indio_dev);
++ ret = ade9000_request_irq(dev, "irq0", ade9000_irq0_thread, indio_dev);
+ if (ret)
+ return ret;
+
+- ret = ade9000_request_irq(dev, "dready", ade9000_dready_thread, indio_dev);
++ ret = ade9000_request_irq(dev, "irq1", ade9000_irq1_thread, indio_dev);
+ if (ret)
+ return ret;
+
+- ret = devm_mutex_init(dev, &st->lock);
++ ret = ade9000_request_irq(dev, "dready", ade9000_dready_thread, indio_dev);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 Mon Sep 17 00:00:00 2001
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+Date: Tue, 3 Mar 2026 10:38:26 +0800
+Subject: iio: adc: aspeed: clear reference voltage bits before configuring vref
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+commit 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 upstream.
+
+Ensures the reference voltage bits are cleared in the ADC engine
+control register before configuring the voltage reference. This
+avoids potential misconfigurations caused by residual bits.
+
+Fixes: 1b5ceb55fec2 ("iio: adc: aspeed: Support ast2600 adc.")
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/aspeed_adc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/aspeed_adc.c
++++ b/drivers/iio/adc/aspeed_adc.c
+@@ -415,6 +415,7 @@ static int aspeed_adc_vref_config(struct
+ }
+ adc_engine_control_reg_val =
+ readl(data->base + ASPEED_REG_ENGINE_CONTROL);
++ adc_engine_control_reg_val &= ~ASPEED_ADC_REF_VOLTAGE;
+
+ ret = devm_regulator_get_enable_read_voltage(data->dev, "vref");
+ if (ret < 0 && ret != -ENODEV)
--- /dev/null
+From d20bbae6e5d408a8a7c2a4344d76dd1ac557a149 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 5 Mar 2026 11:21:53 -0800
+Subject: iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get()
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit d20bbae6e5d408a8a7c2a4344d76dd1ac557a149 upstream.
+
+GPIO state was inadvertently overwritten by the result of spi_sync(),
+resulting in ti_ads7950_get() only returning 0 as GPIO state (or error).
+
+Fix this by introducing a separate variable to hold the state.
+
+Fixes: c97dce792dc8 ("iio: adc: ti-ads7950: add GPIO support")
+Reported-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-ads7950.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/adc/ti-ads7950.c
++++ b/drivers/iio/adc/ti-ads7950.c
+@@ -427,13 +427,15 @@ static int ti_ads7950_set(struct gpio_ch
+ static int ti_ads7950_get(struct gpio_chip *chip, unsigned int offset)
+ {
+ struct ti_ads7950_state *st = gpiochip_get_data(chip);
++ bool state;
+ int ret;
+
+ mutex_lock(&st->slock);
+
+ /* If set as output, return the output */
+ if (st->gpio_cmd_settings_bitmask & BIT(offset)) {
+- ret = (st->cmd_settings_bitmask & BIT(offset)) ? 1 : 0;
++ state = st->cmd_settings_bitmask & BIT(offset);
++ ret = 0;
+ goto out;
+ }
+
+@@ -444,7 +446,7 @@ static int ti_ads7950_get(struct gpio_ch
+ if (ret)
+ goto out;
+
+- ret = ((st->single_rx >> 12) & BIT(offset)) ? 1 : 0;
++ state = (st->single_rx >> 12) & BIT(offset);
+
+ /* Revert back to original settings */
+ st->cmd_settings_bitmask &= ~TI_ADS7950_CR_GPIO_DATA;
+@@ -456,7 +458,7 @@ static int ti_ads7950_get(struct gpio_ch
+ out:
+ mutex_unlock(&st->slock);
+
+- return ret;
++ return ret ?: state;
+ }
+
+ static int ti_ads7950_get_direction(struct gpio_chip *chip,
--- /dev/null
+From e2fa075d5ce1963e7cb7b0ac708ba567e5af66db Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 5 Mar 2026 11:21:52 -0800
+Subject: iio: adc: ti-ads7950: normalize return value of gpio_get
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit e2fa075d5ce1963e7cb7b0ac708ba567e5af66db upstream.
+
+The GPIO get callback is expected to return 0 or 1 (or a negative error
+code). Ensure that the value returned by ti_ads7950_get() for output
+pins is normalized to the [0, 1] range.
+
+Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-ads7950.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ti-ads7950.c
++++ b/drivers/iio/adc/ti-ads7950.c
+@@ -433,7 +433,7 @@ static int ti_ads7950_get(struct gpio_ch
+
+ /* If set as output, return the output */
+ if (st->gpio_cmd_settings_bitmask & BIT(offset)) {
+- ret = st->cmd_settings_bitmask & BIT(offset);
++ ret = (st->cmd_settings_bitmask & BIT(offset)) ? 1 : 0;
+ goto out;
+ }
+
--- /dev/null
+From c354521708175d776d896f8bdae44b18711eccb6 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Thu, 12 Mar 2026 13:20:24 +0200
+Subject: iio: dac: ad5770r: fix error return in ad5770r_read_raw()
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit c354521708175d776d896f8bdae44b18711eccb6 upstream.
+
+Return the error code from regmap_bulk_read() instead of 0 so
+that I/O failures are properly propagated.
+
+Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5770r.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ad5770r.c
++++ b/drivers/iio/dac/ad5770r.c
+@@ -322,7 +322,7 @@ static int ad5770r_read_raw(struct iio_d
+ chan->address,
+ st->transf_buf, 2);
+ if (ret)
+- return 0;
++ return ret;
+
+ buf16 = get_unaligned_le16(st->transf_buf);
+ *val = buf16 >> 2;
--- /dev/null
+From edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:15 -0600
+Subject: iio: gyro: mpu3050: Fix incorrect free_irq() variable
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream.
+
+The handler for the IRQ part of this driver is mpu3050->trig but,
+in the teardown free_irq() is called with handler mpu3050.
+
+Use correct IRQ handler when calling free_irq().
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1269,7 +1269,7 @@ void mpu3050_common_remove(struct device
+ pm_runtime_disable(dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+- free_irq(mpu3050->irq, mpu3050);
++ free_irq(mpu3050->irq, mpu3050->trig);
+ iio_device_unregister(indio_dev);
+ mpu3050_power_down(mpu3050);
+ }
--- /dev/null
+From 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:16 -0600
+Subject: iio: gyro: mpu3050: Fix irq resource leak
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream.
+
+The interrupt handler is setup but only a few lines down if
+iio_trigger_register() fails the function returns without properly
+releasing the handler.
+
+Add cleanup goto to resolve resource leak.
+
+Detected by Smatch:
+drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
+'irq' from request_threaded_irq() not released on lines: 1124.
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1129,11 +1129,16 @@ static int mpu3050_trigger_probe(struct
+
+ ret = iio_trigger_register(mpu3050->trig);
+ if (ret)
+- return ret;
++ goto err_iio_trigger;
+
+ indio_dev->trig = iio_trigger_get(mpu3050->trig);
+
+ return 0;
++
++err_iio_trigger:
++ free_irq(mpu3050->irq, mpu3050->trig);
++
++ return ret;
+ }
+
+ int mpu3050_common_probe(struct device *dev,
--- /dev/null
+From d14116f6529fa085b1a1b1f224dc9604e4d2a29c Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:18 -0600
+Subject: iio: gyro: mpu3050: Fix out-of-sequence free_irq()
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream.
+
+The triggered buffer is initialized before the IRQ is requested. The
+removal path currently calls iio_triggered_buffer_cleanup() before
+free_irq(). This violates the expected LIFO.
+
+Place free_irq() in the correct location relative to
+iio_triggered_buffer_cleanup().
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1278,9 +1278,9 @@ void mpu3050_common_remove(struct device
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+- iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
++ iio_triggered_buffer_cleanup(indio_dev);
+ mpu3050_power_down(mpu3050);
+ }
+
--- /dev/null
+From 4c05799449108fb0e0a6bd30e65fffc71e60db4d Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:17 -0600
+Subject: iio: gyro: mpu3050: Move iio_device_register() to correct location
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream.
+
+iio_device_register() should be at the end of the probe function to
+prevent race conditions.
+
+Place iio_device_register() at the end of the probe function and place
+iio_device_unregister() accordingly.
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1226,12 +1226,6 @@ int mpu3050_common_probe(struct device *
+ goto err_power_down;
+ }
+
+- ret = iio_device_register(indio_dev);
+- if (ret) {
+- dev_err(dev, "device register failed\n");
+- goto err_cleanup_buffer;
+- }
+-
+ dev_set_drvdata(dev, indio_dev);
+
+ /* Check if we have an assigned IRQ to use as trigger */
+@@ -1254,9 +1248,20 @@ int mpu3050_common_probe(struct device *
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_put(dev);
+
++ ret = iio_device_register(indio_dev);
++ if (ret) {
++ dev_err(dev, "device register failed\n");
++ goto err_iio_device_register;
++ }
++
+ return 0;
+
+-err_cleanup_buffer:
++err_iio_device_register:
++ pm_runtime_get_sync(dev);
++ pm_runtime_put_noidle(dev);
++ pm_runtime_disable(dev);
++ if (irq)
++ free_irq(mpu3050->irq, mpu3050->trig);
+ iio_triggered_buffer_cleanup(indio_dev);
+ err_power_down:
+ mpu3050_power_down(mpu3050);
+@@ -1269,13 +1274,13 @@ void mpu3050_common_remove(struct device
+ struct iio_dev *indio_dev = dev_get_drvdata(dev);
+ struct mpu3050 *mpu3050 = iio_priv(indio_dev);
+
++ iio_device_unregister(indio_dev);
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
+- iio_device_unregister(indio_dev);
+ mpu3050_power_down(mpu3050);
+ }
+
--- /dev/null
+From ea7e2e43d768102e2601dbbda42041c78d7a99f9 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Fri, 27 Feb 2026 14:20:46 +0200
+Subject: iio: imu: adis16550: fix swapped gyro/accel filter functions
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit ea7e2e43d768102e2601dbbda42041c78d7a99f9 upstream.
+
+The low-pass filter handlers for IIO_ANGL_VEL and IIO_ACCEL call each
+other's filter functions in both read_raw and write_raw. Swap them so
+each channel type uses its correct filter accessor.
+
+Fixes: bac4368fab62 ("iio: imu: adis16550: add adis16550 support")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Acked-by: Robert Budai <robert.budai@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/adis16550.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/imu/adis16550.c
++++ b/drivers/iio/imu/adis16550.c
+@@ -643,12 +643,12 @@ static int adis16550_read_raw(struct iio
+ case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
+ switch (chan->type) {
+ case IIO_ANGL_VEL:
+- ret = adis16550_get_accl_filter_freq(st, val);
++ ret = adis16550_get_gyro_filter_freq(st, val);
+ if (ret)
+ return ret;
+ return IIO_VAL_INT;
+ case IIO_ACCEL:
+- ret = adis16550_get_gyro_filter_freq(st, val);
++ ret = adis16550_get_accl_filter_freq(st, val);
+ if (ret)
+ return ret;
+ return IIO_VAL_INT;
+@@ -681,9 +681,9 @@ static int adis16550_write_raw(struct ii
+ case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
+ switch (chan->type) {
+ case IIO_ANGL_VEL:
+- return adis16550_set_accl_filter_freq(st, val);
+- case IIO_ACCEL:
+ return adis16550_set_gyro_filter_freq(st, val);
++ case IIO_ACCEL:
++ return adis16550_set_accl_filter_freq(st, val);
+ default:
+ return -EINVAL;
+ }
--- /dev/null
+From c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+Date: Mon, 9 Mar 2026 20:45:45 -0700
+Subject: iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+commit c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 upstream.
+
+If 'pin' is not one of its expected values, the value of
+'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes
+Clang to generate undefined behavior, resulting in the following
+warning:
+
+ drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume()
+
+Prevent the UB and improve error handling by returning an error if 'pin'
+has an unexpected value.
+
+While at it, simplify the code a bit by moving the 'pin_name' assignment
+to the first switch statement.
+
+Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/bmi160/bmi160_core.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/drivers/iio/imu/bmi160/bmi160_core.c
++++ b/drivers/iio/imu/bmi160/bmi160_core.c
+@@ -573,12 +573,16 @@ static int bmi160_config_pin(struct regm
+ int_out_ctrl_shift = BMI160_INT1_OUT_CTRL_SHIFT;
+ int_latch_mask = BMI160_INT1_LATCH_MASK;
+ int_map_mask = BMI160_INT1_MAP_DRDY_EN;
++ pin_name = "INT1";
+ break;
+ case BMI160_PIN_INT2:
+ int_out_ctrl_shift = BMI160_INT2_OUT_CTRL_SHIFT;
+ int_latch_mask = BMI160_INT2_LATCH_MASK;
+ int_map_mask = BMI160_INT2_MAP_DRDY_EN;
++ pin_name = "INT2";
+ break;
++ default:
++ return -EINVAL;
+ }
+ int_out_ctrl_mask = BMI160_INT_OUT_CTRL_MASK << int_out_ctrl_shift;
+
+@@ -612,17 +616,8 @@ static int bmi160_config_pin(struct regm
+ ret = bmi160_write_conf_reg(regmap, BMI160_REG_INT_MAP,
+ int_map_mask, int_map_mask,
+ write_usleep);
+- if (ret) {
+- switch (pin) {
+- case BMI160_PIN_INT1:
+- pin_name = "INT1";
+- break;
+- case BMI160_PIN_INT2:
+- pin_name = "INT2";
+- break;
+- }
++ if (ret)
+ dev_err(dev, "Failed to configure %s IRQ pin", pin_name);
+- }
+
+ return ret;
+ }
--- /dev/null
+From 679c04c10d65d32a3f269e696b22912ff0a001b9 Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <flavra@baylibre.com>
+Date: Wed, 25 Feb 2026 11:06:01 +0100
+Subject: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
+
+From: Francesco Lavra <flavra@baylibre.com>
+
+commit 679c04c10d65d32a3f269e696b22912ff0a001b9 upstream.
+
+The st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace
+writes the buffer sampling frequency sysfs attribute, calls
+st_lsm6dsx_check_odr(), which accesses the odr_table array at index
+`sensor->id`; since this array is only 2 entries long, an access for any
+sensor type other than accelerometer or gyroscope is an out-of-bounds
+access.
+
+The motivation for being able to set a buffer frequency different from the
+sensor sampling frequency is to support use cases that need accurate event
+detection (which requires a high sampling frequency) while retrieving
+sensor data at low frequency. Since all the supported event types are
+generated from acceleration data only, do not create the buffer sampling
+frequency attribute for sensor types other than the accelerometer.
+
+Fixes: 6b648a36c200 ("iio: imu: st_lsm6dsx: Decouple sensor ODR from FIFO batch data rate")
+Signed-off-by: Francesco Lavra <flavra@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+@@ -862,12 +862,21 @@ int st_lsm6dsx_fifo_setup(struct st_lsm6
+ int i, ret;
+
+ for (i = 0; i < ST_LSM6DSX_ID_MAX; i++) {
++ const struct iio_dev_attr **attrs;
++
+ if (!hw->iio_devs[i])
+ continue;
+
++ /*
++ * For the accelerometer, allow setting FIFO sampling frequency
++ * values different from the sensor sampling frequency, which
++ * may be needed to keep FIFO data rate low while sampling
++ * acceleration data at high rates for accurate event detection.
++ */
++ attrs = i == ST_LSM6DSX_ID_ACC ? st_lsm6dsx_buffer_attrs : NULL;
+ ret = devm_iio_kfifo_buffer_setup_ext(hw->dev, hw->iio_devs[i],
+ &st_lsm6dsx_buffer_ops,
+- st_lsm6dsx_buffer_attrs);
++ attrs);
+ if (ret)
+ return ret;
+ }
--- /dev/null
+From 630748afa7030b272b7bee5df857e7bcf132ed51 Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <flavra@baylibre.com>
+Date: Wed, 25 Feb 2026 11:06:00 +0100
+Subject: iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
+
+From: Francesco Lavra <flavra@baylibre.com>
+
+commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream.
+
+The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and
+disabling the hardware FIFO, checks the contents of the hw->settings->batch
+array at index sensor->id, and then sets the current ODR value in sensor
+registers that depend on whether the register address is set in the above
+array element. This logic is valid for internal sensors only, i.e. the
+accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu:
+st_lsm6dsx: add i2c embedded controller support"), this function is called
+also when configuring the hardware FIFO for external sensors (i.e. sensors
+accessed through the sensor hub functionality), which can result in
+unrelated device registers being written.
+
+Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does
+not touch any registers unless it is called for internal sensors.
+
+Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
+Signed-off-by: Francesco Lavra <flavra@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+@@ -225,6 +225,10 @@ static int st_lsm6dsx_set_fifo_odr(struc
+ const struct st_lsm6dsx_reg *batch_reg;
+ u8 data;
+
++ /* Only internal sensors have a FIFO ODR configuration register. */
++ if (sensor->id >= ARRAY_SIZE(hw->settings->batch))
++ return 0;
++
+ batch_reg = &hw->settings->batch[sensor->id];
+ if (batch_reg->addr) {
+ int val;
--- /dev/null
+From fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Sat, 14 Mar 2026 17:18:10 -0500
+Subject: iio: light: vcnl4035: fix scan buffer on big-endian
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream.
+
+Rework vcnl4035_trigger_consumer_handler() so that we are not passing
+what should be a u16 value as an int * to regmap_read(). This won't
+work on bit endian systems.
+
+Instead, add a new unsigned int variable to pass to regmap_read(). Then
+copy that value into the buffer struct.
+
+The buffer array is replaced with a struct since there is only one value
+being read. This allows us to use the correct u16 data type and has a
+side-effect of simplifying the alignment specification.
+
+Also fix the endianness of the scan format from little-endian to CPU
+endianness. Since we are using regmap to read the value, it will be
+CPU-endian.
+
+Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/vcnl4035.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/light/vcnl4035.c
++++ b/drivers/iio/light/vcnl4035.c
+@@ -103,17 +103,23 @@ static irqreturn_t vcnl4035_trigger_cons
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct vcnl4035_data *data = iio_priv(indio_dev);
+ /* Ensure naturally aligned timestamp */
+- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { };
++ struct {
++ u16 als_data;
++ aligned_s64 timestamp;
++ } buffer = { };
++ unsigned int val;
+ int ret;
+
+- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer);
++ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val);
+ if (ret < 0) {
+ dev_err(&data->client->dev,
+ "Trigger consumer can't read from sensor.\n");
+ goto fail_read;
+ }
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+- iio_get_time_ns(indio_dev));
++
++ buffer.als_data = val;
++ iio_push_to_buffers_with_timestamp(indio_dev, &buffer,
++ iio_get_time_ns(indio_dev));
+
+ fail_read:
+ iio_trigger_notify_done(indio_dev->trig);
+@@ -381,7 +387,7 @@ static const struct iio_chan_spec vcnl40
+ .sign = 'u',
+ .realbits = 16,
+ .storagebits = 16,
+- .endianness = IIO_LE,
++ .endianness = IIO_CPU,
+ },
+ },
+ {
+@@ -395,7 +401,7 @@ static const struct iio_chan_spec vcnl40
+ .sign = 'u',
+ .realbits = 16,
+ .storagebits = 16,
+- .endianness = IIO_LE,
++ .endianness = IIO_CPU,
+ },
+ },
+ };
--- /dev/null
+From d0b224cf9ab12e86a4d1ca55c760dfaa5c19cbe7 Mon Sep 17 00:00:00 2001
+From: Aldo Conte <aldocontelk@gmail.com>
+Date: Wed, 25 Mar 2026 12:32:16 +0100
+Subject: iio: light: veml6070: fix veml6070_read() return value
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aldo Conte <aldocontelk@gmail.com>
+
+commit d0b224cf9ab12e86a4d1ca55c760dfaa5c19cbe7 upstream.
+
+veml6070_read() computes the sensor value in ret but
+returns 0 instead of the actual result. This causes
+veml6070_read_raw() to always report 0.
+
+Return the computed value instead of 0.
+
+Running make W=1 returns no errors. I was unable
+to test the patch because I do not have the hardware.
+Found by code inspection.
+
+Fixes: fc38525135dd ("iio: light: veml6070: use guard to handle mutex")
+Signed-off-by: Aldo Conte <aldocontelk@gmail.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/veml6070.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/iio/light/veml6070.c
++++ b/drivers/iio/light/veml6070.c
+@@ -134,9 +134,7 @@ static int veml6070_read(struct veml6070
+ if (ret < 0)
+ return ret;
+
+- ret = (msb << 8) | lsb;
+-
+- return 0;
++ return (msb << 8) | lsb;
+ }
+
+ static const struct iio_chan_spec veml6070_channels[] = {
--- /dev/null
+From fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda Mon Sep 17 00:00:00 2001
+From: Liam Mitchell <mitchell.liam@gmail.com>
+Date: Wed, 18 Feb 2026 14:21:35 -0800
+Subject: Input: bcm5974 - recover from failed mode switch
+
+From: Liam Mitchell <mitchell.liam@gmail.com>
+
+commit fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda upstream.
+
+Mode switches sent before control response are ignored. This results in
+an unresponsive trackpad and "bcm5974: bad trackpad package, length: 8"
+repeated in logs.
+
+On receiving unknown 8-byte packets, assume that mode switch was ignored
+and schedule an asynchronous mode reset. The reset will switch the
+device to normal mode, wait, then switch back to wellspring mode.
+
+Signed-off-by: Liam Mitchell <mitchell.liam@gmail.com>
+Link: https://lore.kernel.org/linux-input/CAOQ1CL4+DP1TuLAGNsz5GdFBTHvnTg=5q=Dr2Z1OQc6RXydSYA@mail.gmail.com/
+Acked-by: Henrik Rydberg <rydberg@bitmath.org>
+Link: https://patch.msgid.link/20260213-bcm5974-reset-v2-1-1837851336b0@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/bcm5974.c | 42 +++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 41 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -286,6 +286,8 @@ struct bcm5974 {
+ const struct tp_finger *index[MAX_FINGERS]; /* finger index data */
+ struct input_mt_pos pos[MAX_FINGERS]; /* position array */
+ int slots[MAX_FINGERS]; /* slot assignments */
++ struct work_struct mode_reset_work;
++ unsigned long last_mode_reset;
+ };
+
+ /* trackpad finger block data, le16-aligned */
+@@ -696,6 +698,32 @@ static int bcm5974_wellspring_mode(struc
+ return retval;
+ }
+
++/*
++ * Mode switches sent before the control response are ignored.
++ * Fixing this state requires switching to normal mode and waiting
++ * about 1ms before switching back to wellspring mode.
++ */
++static void bcm5974_mode_reset_work(struct work_struct *work)
++{
++ struct bcm5974 *dev = container_of(work, struct bcm5974, mode_reset_work);
++ int error;
++
++ guard(mutex)(&dev->pm_mutex);
++ dev->last_mode_reset = jiffies;
++
++ error = bcm5974_wellspring_mode(dev, false);
++ if (error) {
++ dev_err(&dev->intf->dev, "reset to normal mode failed\n");
++ return;
++ }
++
++ fsleep(1000);
++
++ error = bcm5974_wellspring_mode(dev, true);
++ if (error)
++ dev_err(&dev->intf->dev, "mode switch after reset failed\n");
++}
++
+ static void bcm5974_irq_button(struct urb *urb)
+ {
+ struct bcm5974 *dev = urb->context;
+@@ -752,10 +780,20 @@ static void bcm5974_irq_trackpad(struct
+ if (dev->tp_urb->actual_length == 2)
+ goto exit;
+
+- if (report_tp_state(dev, dev->tp_urb->actual_length))
++ if (report_tp_state(dev, dev->tp_urb->actual_length)) {
+ dprintk(1, "bcm5974: bad trackpad package, length: %d\n",
+ dev->tp_urb->actual_length);
+
++ /*
++ * Receiving a HID packet means we aren't in wellspring mode.
++ * If we haven't tried a reset in the last second, try now.
++ */
++ if (dev->tp_urb->actual_length == 8 &&
++ time_after(jiffies, dev->last_mode_reset + msecs_to_jiffies(1000))) {
++ schedule_work(&dev->mode_reset_work);
++ }
++ }
++
+ exit:
+ error = usb_submit_urb(dev->tp_urb, GFP_ATOMIC);
+ if (error)
+@@ -906,6 +944,7 @@ static int bcm5974_probe(struct usb_inte
+ dev->intf = iface;
+ dev->input = input_dev;
+ dev->cfg = *cfg;
++ INIT_WORK(&dev->mode_reset_work, bcm5974_mode_reset_work);
+ mutex_init(&dev->pm_mutex);
+
+ /* setup urbs */
+@@ -998,6 +1037,7 @@ static void bcm5974_disconnect(struct us
+ {
+ struct bcm5974 *dev = usb_get_intfdata(iface);
+
++ disable_work_sync(&dev->mode_reset_work);
+ usb_set_intfdata(iface, NULL);
+
+ input_unregister_device(dev->input);
--- /dev/null
+From 5839419cffc7788a356428d321e3ec18055c0286 Mon Sep 17 00:00:00 2001
+From: Christoffer Sandberg <cs@tuxedo.de>
+Date: Mon, 23 Feb 2026 15:20:45 +0100
+Subject: Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+commit 5839419cffc7788a356428d321e3ec18055c0286 upstream.
+
+The device occasionally wakes up from suspend with missing input on the
+internal keyboard and the following suspend attempt results in an instant
+wake-up. The quirks fix both issues for this device.
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
--- /dev/null
+From 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 23 Feb 2026 15:05:15 -0800
+Subject: Input: synaptics-rmi4 - fix a locking bug in an error path
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream.
+
+Lock f54->data_mutex when entering the function statement since jumping
+to the 'error' label when checking report_size fails causes that mutex
+to be unlocked.
+
+This bug has been detected by the Clang thread-safety checker.
+
+Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/rmi4/rmi_f54.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_f54.c
++++ b/drivers/input/rmi4/rmi_f54.c
+@@ -538,6 +538,8 @@ static void rmi_f54_work(struct work_str
+ int error;
+ int i;
+
++ mutex_lock(&f54->data_mutex);
++
+ report_size = rmi_f54_get_report_size(f54);
+ if (report_size == 0) {
+ dev_err(&fn->dev, "Bad report size, report type=%d\n",
+@@ -546,8 +548,6 @@ static void rmi_f54_work(struct work_str
+ goto error; /* retry won't help */
+ }
+
+- mutex_lock(&f54->data_mutex);
+-
+ /*
+ * Need to check if command has completed.
+ * If not try again later.
--- /dev/null
+From 0d9363a764d9d601a05591f9695cea8b429e9be3 Mon Sep 17 00:00:00 2001
+From: Shengyu Qu <wiagn233@outlook.com>
+Date: Fri, 3 Apr 2026 22:07:28 -0700
+Subject: Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
+
+From: Shengyu Qu <wiagn233@outlook.com>
+
+commit 0d9363a764d9d601a05591f9695cea8b429e9be3 upstream.
+
+BETOP's BTP-KP50B and BTP-KP50C controller's wireless dongles are both
+working as standard Xbox 360 controllers. Add USB device IDs for them to
+xpad driver.
+
+Signed-off-by: Shengyu Qu <wiagn233@outlook.com>
+Link: https://patch.msgid.link/TY4PR01MB14432B4B298EA186E5F86C46B9855A@TY4PR01MB14432.jpnprd01.prod.outlook.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -360,6 +360,8 @@ static const struct xpad_device {
+ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
+ { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 },
++ { 0x20bc, 0x5134, "BETOP BTP-KP50B Xinput Dongle", 0, XTYPE_XBOX360 },
++ { 0x20bc, 0x514a, "BETOP BTP-KP50C Xinput Dongle", 0, XTYPE_XBOX360 },
+ { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x2064, "PowerA Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
+@@ -562,6 +564,7 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */
+ XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */
+ XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */
++ XPAD_XBOX360_VENDOR(0x20bc), /* BETOP wireless dongles */
+ XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */
+ XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */
+ XPAD_XBOX360_VENDOR(0x2345), /* Machenike Controllers */
--- /dev/null
+From e2b0ae529db4766584e77647cefe3ec15c3d842e Mon Sep 17 00:00:00 2001
+From: Zoltan Illes <zoliviragh@gmail.com>
+Date: Fri, 3 Apr 2026 22:03:42 -0700
+Subject: Input: xpad - add support for Razer Wolverine V3 Pro
+
+From: Zoltan Illes <zoliviragh@gmail.com>
+
+commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream.
+
+Add device IDs for the Razer Wolverine V3 Pro controller in both
+wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.
+
+The controller uses the Xbox 360 protocol (vendor-specific class,
+subclass 93, protocol 1) on interface 0 with an identical 20-byte
+input report layout, so no additional processing is needed.
+
+Signed-off-by: Zoltan Illes <zoliviragh@gmail.com>
+Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -313,6 +313,8 @@ static const struct xpad_device {
+ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
++ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 },
++ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
--- /dev/null
+From 8c27b1bce059a11a8d3c8682984e13866f0714af Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 30 Mar 2026 11:38:30 +0300
+Subject: mei: me: reduce the scope on unexpected reset
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 8c27b1bce059a11a8d3c8682984e13866f0714af upstream.
+
+After commit 2cedb296988c ("mei: me: trigger link reset if hw ready is unexpected")
+some devices started to show long resume times (5-7 seconds).
+This happens as mei falsely detects unready hardware,
+starts parallel link reset flow and triggers link reset timeouts
+in the resume callback.
+
+Address it by performing detection of unready hardware only
+when driver is in the MEI_DEV_ENABLED state instead of blacklisting
+states as done in the original patch.
+This eliminates active waitqueue check as in MEI_DEV_ENABLED state
+there will be no active waitqueue.
+
+Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
+Reported-by: Todd Brandt <todd.e.brandt@linux.intel.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221023
+Tested-by: Todd Brandt <todd.e.brandt@linux.intel.com>
+Fixes: 2cedb296988c ("mei: me: trigger link reset if hw ready is unexpected")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Link: https://patch.msgid.link/20260330083830.536056-1-alexander.usyskin@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -1337,19 +1337,13 @@ irqreturn_t mei_me_irq_thread_handler(in
+ /* check if we need to start the dev */
+ if (!mei_host_is_ready(dev)) {
+ if (mei_hw_is_ready(dev)) {
+- /* synchronized by dev mutex */
+- if (waitqueue_active(&dev->wait_hw_ready)) {
+- dev_dbg(&dev->dev, "we need to start the dev.\n");
+- dev->recvd_hw_ready = true;
+- wake_up(&dev->wait_hw_ready);
+- } else if (dev->dev_state != MEI_DEV_UNINITIALIZED &&
+- dev->dev_state != MEI_DEV_POWERING_DOWN &&
+- dev->dev_state != MEI_DEV_POWER_DOWN) {
++ if (dev->dev_state == MEI_DEV_ENABLED) {
+ dev_dbg(&dev->dev, "Force link reset.\n");
+ schedule_work(&dev->reset_work);
+ } else {
+- dev_dbg(&dev->dev, "Ignore this interrupt in state = %d\n",
+- dev->dev_state);
++ dev_dbg(&dev->dev, "we need to start the dev.\n");
++ dev->recvd_hw_ready = true;
++ wake_up(&dev->wait_hw_ready);
+ }
+ } else {
+ dev_dbg(&dev->dev, "Spurious Interrupt\n");
usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch
usb-serial-option-add-support-for-rolling-wireless-rw135r-gl.patch
usb-core-add-no_lpm-quirk-for-razer-kiyo-pro-webcam.patch
+input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch
+input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch
+input-bcm5974-recover-from-failed-mode-switch.patch
+input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch
+input-xpad-add-support-for-razer-wolverine-v3-pro.patch
+iio-adc-ti-ads7950-normalize-return-value-of-gpio_get.patch
+iio-adc-ti-ads7950-do-not-clobber-gpio-state-in-ti_ads7950_get.patch
+iio-adc-ade9000-fix-wrong-return-type-in-streaming-push.patch
+iio-adc-ade9000-fix-wrong-register-in-calibbias-case-for-active-power.patch
+iio-adc-ade9000-move-mutex-init-before-irq-registration.patch
+iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch
+iio-accel-fix-adxl355-temperature-signature-value.patch
+iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch
+iio-accel-adxl313-add-missing-error-check-in-predisable.patch
+iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch
+iio-imu-adis16550-fix-swapped-gyro-accel-filter-functions.patch
+iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch
+iio-light-veml6070-fix-veml6070_read-return-value.patch
+iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch
+iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch
+iio-imu-st_lsm6dsx-set-buffer-sampling-frequency-for-accelerometer-only.patch
+iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch
+iio-gyro-mpu3050-fix-irq-resource-leak.patch
+iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch
+iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch
+mei-me-reduce-the-scope-on-unexpected-reset.patch
+gpib-lpvo_usb-fix-memory-leak-on-disconnect.patch
+usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch
+usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch
+usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch
+usb-misc-usbio-fix-urb-memory-leak-on-submit-failure.patch
+usb-host-xhci-sideband-delegate-offload_usage-tracking-to-class-drivers.patch
+usb-ehci-brcm-fix-sleep-during-atomic.patch
+usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch
+usb-core-phy-avoid-double-use-of-usb3-phy.patch
+usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch
+usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch
+usb-core-use-dedicated-spinlock-for-offload-state.patch
--- /dev/null
+From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001
+From: Yongchao Wu <yongchao.wu@autochips.com>
+Date: Tue, 31 Mar 2026 08:04:07 +0800
+Subject: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
+
+From: Yongchao Wu <yongchao.wu@autochips.com>
+
+commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream.
+
+When the gadget endpoint is disabled or not yet configured, the ep->desc
+pointer can be NULL. This leads to a NULL pointer dereference when
+__cdns3_gadget_ep_queue() is called, causing a kernel crash.
+
+Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
+standard return code for unconfigured endpoints.
+
+This prevents potential crashes when ep_queue is called on endpoints
+that are not ready.
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struc
+ struct cdns3_request *priv_req;
+ int ret = 0;
+
++ if (!ep->desc)
++ return -ESHUTDOWN;
++
+ request->actual = 0;
+ request->status = -EINPROGRESS;
+ priv_req = to_cdns3_request(request);
--- /dev/null
+From c32f8748d70c8fc77676ad92ed76cede17bf2c48 Mon Sep 17 00:00:00 2001
+From: Yongchao Wu <yongchao.wu@autochips.com>
+Date: Wed, 1 Apr 2026 08:10:00 +0800
+Subject: usb: cdns3: gadget: fix state inconsistency on gadget init failure
+
+From: Yongchao Wu <yongchao.wu@autochips.com>
+
+commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream.
+
+When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode
+while software state remains INACTIVE, creating hardware/software state
+inconsistency.
+
+When switching to host mode via sysfs:
+ echo host > /sys/class/usb_role/13180000.usb-role-switch/role
+
+The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,
+so cdns_role_stop() skips cleanup because state is still INACTIVE.
+This violates the DRD controller design specification (Figure22),
+which requires returning to idle state before switching roles.
+
+This leads to a synchronous external abort in xhci_gen_setup() when
+setting up the host controller:
+
+[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19
+[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget
+[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed
+...
+[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
+[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
+[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408
+[ 1301.393391] backtrace:
+ ...
+ xhci_gen_setup+0xa4/0x408 <-- CRASH
+ xhci_plat_setup+0x44/0x58
+ usb_add_hcd+0x284/0x678
+ ...
+ cdns_role_set+0x9c/0xbc <-- Role switch
+
+Fix by calling cdns_drd_gadget_off() in the error path to properly
+clean up the DRD gadget state.
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -3431,6 +3431,7 @@ static int __cdns3_gadget_init(struct cd
+ ret = cdns3_gadget_start(cdns);
+ if (ret) {
+ pm_runtime_put_sync(cdns->dev);
++ cdns_drd_gadget_off(cdns);
+ return ret;
+ }
+
--- /dev/null
+From 0179c6da0793ae03607002c284b53b6d584172d0 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Mon, 30 Mar 2026 17:02:42 +0200
+Subject: usb: core: phy: avoid double use of 'usb3-phy'
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+commit 0179c6da0793ae03607002c284b53b6d584172d0 upstream.
+
+Commit 53a2d95df836 ("usb: core: add phy notify connect and disconnect")
+causes double use of the 'usb3-phy' in certain cases.
+
+Since that commit, if a generic PHY named 'usb3-phy' is specified in
+the device tree, that is getting added to the 'phy_roothub' list of the
+secondary HCD by the usb_phy_roothub_alloc_usb3_phy() function. However,
+that PHY is getting added also to the primary HCD's 'phy_roothub' list
+by usb_phy_roothub_alloc() if there is no generic PHY specified with
+'usb2-phy' name.
+
+This causes that the usb_add_hcd() function executes each phy operations
+twice on the 'usb3-phy'. Once when the primary HCD is added, then once
+again when the secondary HCD is added.
+
+The issue affects the Marvell Armada 3700 platform at least, where a
+custom name is used for the USB2 PHY:
+
+ $ git grep 'phy-names.*usb3' arch/arm64/boot/dts/marvell/armada-37xx.dtsi | tr '\t' ' '
+ arch/arm64/boot/dts/marvell/armada-37xx.dtsi: phy-names = "usb3-phy", "usb2-utmi-otg-phy";
+
+Extend the usb_phy_roothub_alloc_usb3_phy() function to skip adding the
+'usb3-phy' to the 'phy_roothub' list of the secondary HCD when 'usb2-phy'
+is not specified in the device tree to avoid the double use.
+
+Fixes: 53a2d95df836 ("usb: core: add phy notify connect and disconnect")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://patch.msgid.link/20260330-usb-avoid-usb3-phy-double-use-v1-1-d2113aecb535@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/phy.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/phy.c
++++ b/drivers/usb/core/phy.c
+@@ -114,7 +114,7 @@ EXPORT_SYMBOL_GPL(usb_phy_roothub_alloc)
+ struct usb_phy_roothub *usb_phy_roothub_alloc_usb3_phy(struct device *dev)
+ {
+ struct usb_phy_roothub *phy_roothub;
+- int num_phys;
++ int num_phys, usb2_phy_index;
+
+ if (!IS_ENABLED(CONFIG_GENERIC_PHY))
+ return NULL;
+@@ -124,6 +124,16 @@ struct usb_phy_roothub *usb_phy_roothub_
+ if (num_phys <= 0)
+ return NULL;
+
++ /*
++ * If 'usb2-phy' is not present, usb_phy_roothub_alloc() added
++ * all PHYs to the primary HCD's phy_roothub already, so skip
++ * adding 'usb3-phy' here to avoid double use of that.
++ */
++ usb2_phy_index = of_property_match_string(dev->of_node, "phy-names",
++ "usb2-phy");
++ if (usb2_phy_index < 0)
++ return NULL;
++
+ phy_roothub = devm_kzalloc(dev, sizeof(*phy_roothub), GFP_KERNEL);
+ if (!phy_roothub)
+ return ERR_PTR(-ENOMEM);
--- /dev/null
+From bd3d245b0fef571f93504904df62b8865b1c0d34 Mon Sep 17 00:00:00 2001
+From: Guan-Yu Lin <guanyulin@google.com>
+Date: Wed, 1 Apr 2026 12:32:17 +0000
+Subject: usb: core: use dedicated spinlock for offload state
+
+From: Guan-Yu Lin <guanyulin@google.com>
+
+commit bd3d245b0fef571f93504904df62b8865b1c0d34 upstream.
+
+Replace the coarse USB device lock with a dedicated offload_lock
+spinlock to reduce contention during offload operations. Use
+offload_pm_locked to synchronize with PM transitions and replace
+the legacy offload_at_suspend flag.
+
+Optimize usb_offload_get/put by switching from auto-resume/suspend
+to pm_runtime_get_if_active(). This ensures offload state is only
+modified when the device is already active, avoiding unnecessary
+power transitions.
+
+Cc: stable <stable@kernel.org>
+Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage")
+Signed-off-by: Guan-Yu Lin <guanyulin@google.com>
+Tested-by: Hailong Liu <hailong.liu@oppo.com>
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20260401123238.3790062-2-guanyulin@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/driver.c | 23 +++++---
+ drivers/usb/core/offload.c | 102 ++++++++++++++++++++++-----------------
+ drivers/usb/core/usb.c | 1
+ drivers/usb/host/xhci-sideband.c | 4 -
+ include/linux/usb.h | 10 +++
+ 5 files changed, 84 insertions(+), 56 deletions(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1415,14 +1415,16 @@ static int usb_suspend_both(struct usb_d
+ int status = 0;
+ int i = 0, n = 0;
+ struct usb_interface *intf;
++ bool offload_active = false;
+
+ if (udev->state == USB_STATE_NOTATTACHED ||
+ udev->state == USB_STATE_SUSPENDED)
+ goto done;
+
++ usb_offload_set_pm_locked(udev, true);
+ if (msg.event == PM_EVENT_SUSPEND && usb_offload_check(udev)) {
+ dev_dbg(&udev->dev, "device offloaded, skip suspend.\n");
+- udev->offload_at_suspend = 1;
++ offload_active = true;
+ }
+
+ /* Suspend all the interfaces and then udev itself */
+@@ -1436,8 +1438,7 @@ static int usb_suspend_both(struct usb_d
+ * interrupt urbs, allowing interrupt events to be
+ * handled during system suspend.
+ */
+- if (udev->offload_at_suspend &&
+- intf->needs_remote_wakeup) {
++ if (offload_active && intf->needs_remote_wakeup) {
+ dev_dbg(&intf->dev,
+ "device offloaded, skip suspend.\n");
+ continue;
+@@ -1452,7 +1453,7 @@ static int usb_suspend_both(struct usb_d
+ }
+ }
+ if (status == 0) {
+- if (!udev->offload_at_suspend)
++ if (!offload_active)
+ status = usb_suspend_device(udev, msg);
+
+ /*
+@@ -1498,7 +1499,7 @@ static int usb_suspend_both(struct usb_d
+ */
+ } else {
+ udev->can_submit = 0;
+- if (!udev->offload_at_suspend) {
++ if (!offload_active) {
+ for (i = 0; i < 16; ++i) {
+ usb_hcd_flush_endpoint(udev, udev->ep_out[i]);
+ usb_hcd_flush_endpoint(udev, udev->ep_in[i]);
+@@ -1507,6 +1508,8 @@ static int usb_suspend_both(struct usb_d
+ }
+
+ done:
++ if (status != 0)
++ usb_offload_set_pm_locked(udev, false);
+ dev_vdbg(&udev->dev, "%s: status %d\n", __func__, status);
+ return status;
+ }
+@@ -1536,16 +1539,19 @@ static int usb_resume_both(struct usb_de
+ int status = 0;
+ int i;
+ struct usb_interface *intf;
++ bool offload_active = false;
+
+ if (udev->state == USB_STATE_NOTATTACHED) {
+ status = -ENODEV;
+ goto done;
+ }
+ udev->can_submit = 1;
++ if (msg.event == PM_EVENT_RESUME)
++ offload_active = usb_offload_check(udev);
+
+ /* Resume the device */
+ if (udev->state == USB_STATE_SUSPENDED || udev->reset_resume) {
+- if (!udev->offload_at_suspend)
++ if (!offload_active)
+ status = usb_resume_device(udev, msg);
+ else
+ dev_dbg(&udev->dev,
+@@ -1562,8 +1568,7 @@ static int usb_resume_both(struct usb_de
+ * pending interrupt urbs, allowing interrupt events
+ * to be handled during system suspend.
+ */
+- if (udev->offload_at_suspend &&
+- intf->needs_remote_wakeup) {
++ if (offload_active && intf->needs_remote_wakeup) {
+ dev_dbg(&intf->dev,
+ "device offloaded, skip resume.\n");
+ continue;
+@@ -1572,11 +1577,11 @@ static int usb_resume_both(struct usb_de
+ udev->reset_resume);
+ }
+ }
+- udev->offload_at_suspend = 0;
+ usb_mark_last_busy(udev);
+
+ done:
+ dev_vdbg(&udev->dev, "%s: status %d\n", __func__, status);
++ usb_offload_set_pm_locked(udev, false);
+ if (!status)
+ udev->reset_resume = 0;
+ return status;
+--- a/drivers/usb/core/offload.c
++++ b/drivers/usb/core/offload.c
+@@ -25,33 +25,30 @@
+ */
+ int usb_offload_get(struct usb_device *udev)
+ {
+- int ret;
++ int ret = 0;
+
+- usb_lock_device(udev);
+- if (udev->state == USB_STATE_NOTATTACHED) {
+- usb_unlock_device(udev);
++ if (!usb_get_dev(udev))
+ return -ENODEV;
+- }
+
+- if (udev->state == USB_STATE_SUSPENDED ||
+- udev->offload_at_suspend) {
+- usb_unlock_device(udev);
+- return -EBUSY;
++ if (pm_runtime_get_if_active(&udev->dev) != 1) {
++ ret = -EBUSY;
++ goto err_rpm;
+ }
+
+- /*
+- * offload_usage could only be modified when the device is active, since
+- * it will alter the suspend flow of the device.
+- */
+- ret = usb_autoresume_device(udev);
+- if (ret < 0) {
+- usb_unlock_device(udev);
+- return ret;
++ spin_lock(&udev->offload_lock);
++
++ if (udev->offload_pm_locked) {
++ ret = -EAGAIN;
++ goto err;
+ }
+
+ udev->offload_usage++;
+- usb_autosuspend_device(udev);
+- usb_unlock_device(udev);
++
++err:
++ spin_unlock(&udev->offload_lock);
++ pm_runtime_put_autosuspend(&udev->dev);
++err_rpm:
++ usb_put_dev(udev);
+
+ return ret;
+ }
+@@ -69,35 +66,32 @@ EXPORT_SYMBOL_GPL(usb_offload_get);
+ */
+ int usb_offload_put(struct usb_device *udev)
+ {
+- int ret;
++ int ret = 0;
+
+- usb_lock_device(udev);
+- if (udev->state == USB_STATE_NOTATTACHED) {
+- usb_unlock_device(udev);
++ if (!usb_get_dev(udev))
+ return -ENODEV;
+- }
+
+- if (udev->state == USB_STATE_SUSPENDED ||
+- udev->offload_at_suspend) {
+- usb_unlock_device(udev);
+- return -EBUSY;
++ if (pm_runtime_get_if_active(&udev->dev) != 1) {
++ ret = -EBUSY;
++ goto err_rpm;
+ }
+
+- /*
+- * offload_usage could only be modified when the device is active, since
+- * it will alter the suspend flow of the device.
+- */
+- ret = usb_autoresume_device(udev);
+- if (ret < 0) {
+- usb_unlock_device(udev);
+- return ret;
++ spin_lock(&udev->offload_lock);
++
++ if (udev->offload_pm_locked) {
++ ret = -EAGAIN;
++ goto err;
+ }
+
+ /* Drop the count when it wasn't 0, ignore the operation otherwise. */
+ if (udev->offload_usage)
+ udev->offload_usage--;
+- usb_autosuspend_device(udev);
+- usb_unlock_device(udev);
++
++err:
++ spin_unlock(&udev->offload_lock);
++ pm_runtime_put_autosuspend(&udev->dev);
++err_rpm:
++ usb_put_dev(udev);
+
+ return ret;
+ }
+@@ -112,25 +106,47 @@ EXPORT_SYMBOL_GPL(usb_offload_put);
+ * management.
+ *
+ * The caller must hold @udev's device lock. In addition, the caller should
+- * ensure downstream usb devices are all either suspended or marked as
+- * "offload_at_suspend" to ensure the correctness of the return value.
++ * ensure the device itself and the downstream usb devices are all marked as
++ * "offload_pm_locked" to ensure the correctness of the return value.
+ *
+ * Returns true on any offload activity, false otherwise.
+ */
+ bool usb_offload_check(struct usb_device *udev) __must_hold(&udev->dev->mutex)
+ {
+ struct usb_device *child;
+- bool active;
++ bool active = false;
+ int port1;
+
++ if (udev->offload_usage)
++ return true;
++
+ usb_hub_for_each_child(udev, port1, child) {
+ usb_lock_device(child);
+ active = usb_offload_check(child);
+ usb_unlock_device(child);
++
+ if (active)
+- return true;
++ break;
+ }
+
+- return !!udev->offload_usage;
++ return active;
+ }
+ EXPORT_SYMBOL_GPL(usb_offload_check);
++
++/**
++ * usb_offload_set_pm_locked - set the PM lock state of a USB device
++ * @udev: the USB device to modify
++ * @locked: the new lock state
++ *
++ * Setting @locked to true prevents offload_usage from being modified. This
++ * ensures that offload activities cannot be started or stopped during critical
++ * power management transitions, maintaining a stable state for the duration
++ * of the transition.
++ */
++void usb_offload_set_pm_locked(struct usb_device *udev, bool locked)
++{
++ spin_lock(&udev->offload_lock);
++ udev->offload_pm_locked = locked;
++ spin_unlock(&udev->offload_lock);
++}
++EXPORT_SYMBOL_GPL(usb_offload_set_pm_locked);
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -671,6 +671,7 @@ struct usb_device *usb_alloc_dev(struct
+ set_dev_node(&dev->dev, dev_to_node(bus->sysdev));
+ dev->state = USB_STATE_ATTACHED;
+ dev->lpm_disable_count = 1;
++ spin_lock_init(&dev->offload_lock);
+ dev->offload_usage = 0;
+ atomic_set(&dev->urbnum, 0);
+
+--- a/drivers/usb/host/xhci-sideband.c
++++ b/drivers/usb/host/xhci-sideband.c
+@@ -285,8 +285,8 @@ EXPORT_SYMBOL_GPL(xhci_sideband_get_even
+ * Allow other drivers, such as usb controller driver, to check if there are
+ * any sideband activity on the host controller. This information could be used
+ * for power management or other forms of resource management. The caller should
+- * ensure downstream usb devices are all either suspended or marked as
+- * "offload_at_suspend" to ensure the correctness of the return value.
++ * ensure downstream usb devices are all marked as "offload_pm_locked" to ensure
++ * the correctness of the return value.
+ *
+ * Returns true on any active sideband existence, false otherwise.
+ */
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -21,6 +21,7 @@
+ #include <linux/completion.h> /* for struct completion */
+ #include <linux/sched.h> /* for current && schedule_timeout */
+ #include <linux/mutex.h> /* for struct mutex */
++#include <linux/spinlock.h> /* for spinlock_t */
+ #include <linux/pm_runtime.h> /* for runtime PM */
+
+ struct usb_device;
+@@ -636,8 +637,9 @@ struct usb3_lpm_parameters {
+ * @do_remote_wakeup: remote wakeup should be enabled
+ * @reset_resume: needs reset instead of resume
+ * @port_is_suspended: the upstream port is suspended (L2 or U3)
+- * @offload_at_suspend: offload activities during suspend is enabled.
++ * @offload_pm_locked: prevents offload_usage changes during PM transitions.
+ * @offload_usage: number of offload activities happening on this usb device.
++ * @offload_lock: protects offload_usage and offload_pm_locked
+ * @slot_id: Slot ID assigned by xHCI
+ * @l1_params: best effor service latency for USB2 L1 LPM state, and L1 timeout.
+ * @u1_params: exit latencies for USB3 U1 LPM state, and hub-initiated timeout.
+@@ -726,8 +728,9 @@ struct usb_device {
+ unsigned do_remote_wakeup:1;
+ unsigned reset_resume:1;
+ unsigned port_is_suspended:1;
+- unsigned offload_at_suspend:1;
++ unsigned offload_pm_locked:1;
+ int offload_usage;
++ spinlock_t offload_lock;
+ enum usb_link_tunnel_mode tunnel_mode;
+ struct device_link *usb4_link;
+
+@@ -849,6 +852,7 @@ static inline void usb_mark_last_busy(st
+ int usb_offload_get(struct usb_device *udev);
+ int usb_offload_put(struct usb_device *udev);
+ bool usb_offload_check(struct usb_device *udev);
++void usb_offload_set_pm_locked(struct usb_device *udev, bool locked);
+ #else
+
+ static inline int usb_offload_get(struct usb_device *udev)
+@@ -857,6 +861,8 @@ static inline int usb_offload_put(struct
+ { return 0; }
+ static inline bool usb_offload_check(struct usb_device *udev)
+ { return false; }
++static inline void usb_offload_set_pm_locked(struct usb_device *udev, bool locked)
++{ }
+ #endif
+
+ extern int usb_disable_lpm(struct usb_device *udev);
--- /dev/null
+From 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a Mon Sep 17 00:00:00 2001
+From: Juno Choi <juno.choi@lge.com>
+Date: Tue, 24 Mar 2026 10:49:10 +0900
+Subject: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
+
+From: Juno Choi <juno.choi@lge.com>
+
+commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream.
+
+dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,
+which expects hsotg->lock to be held since it does spin_unlock/spin_lock
+around the gadget driver callback invocation.
+
+However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()
+without holding the lock. This leads to:
+ - spin_unlock on a lock that is not held (undefined behavior)
+ - The lock remaining held after dwc2_gadget_exit_clock_gating() returns,
+ causing a deadlock when spin_lock_irqsave() is called later in the
+ same function.
+
+Fix this by acquiring hsotg->lock before calling
+dwc2_gadget_exit_clock_gating() and releasing it afterwards, which
+satisfies the locking requirement of the call_gadget() macro.
+
+Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Juno Choi <juno.choi@lge.com>
+Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4607,7 +4607,9 @@ static int dwc2_hsotg_udc_stop(struct us
+ /* Exit clock gating when driver is stopped. */
+ if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE &&
+ hsotg->bus_suspended && !hsotg->params.no_clock_gating) {
++ spin_lock_irqsave(&hsotg->lock, flags);
+ dwc2_gadget_exit_clock_gating(hsotg, 0);
++ spin_unlock_irqrestore(&hsotg->lock, flags);
+ }
+
+ /* all endpoints should be shutdown */
--- /dev/null
+From 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Mon Sep 17 00:00:00 2001
+From: Justin Chen <justin.chen@broadcom.com>
+Date: Wed, 18 Mar 2026 11:57:07 -0700
+Subject: usb: ehci-brcm: fix sleep during atomic
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream.
+
+echi_brcm_wait_for_sof() gets called after disabling interrupts
+in ehci_brcm_hub_control(). Use the atomic version of poll_timeout
+to fix the warning.
+
+Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ehci-brcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-brcm.c
++++ b/drivers/usb/host/ehci-brcm.c
+@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so
+ int res;
+
+ /* Wait for next microframe (every 125 usecs) */
+- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val,
+- val != frame_idx, 1, 130);
++ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index,
++ val, val != frame_idx, 1, 130);
+ if (res)
+ ehci_err(ehci, "Error waiting for SOF\n");
+ udelay(delay);
--- /dev/null
+From 5abbe6ecc6203355c770bf232ade88e29c960049 Mon Sep 17 00:00:00 2001
+From: Guan-Yu Lin <guanyulin@google.com>
+Date: Wed, 1 Apr 2026 12:32:18 +0000
+Subject: usb: host: xhci-sideband: delegate offload_usage tracking to class drivers
+
+From: Guan-Yu Lin <guanyulin@google.com>
+
+commit 5abbe6ecc6203355c770bf232ade88e29c960049 upstream.
+
+Remove usb_offload_get() and usb_offload_put() from the xHCI sideband
+interrupter creation and removal paths.
+
+The responsibility of manipulating offload_usage now lies entirely with
+the USB class drivers. They have the precise context of when an offload
+data stream actually starts and stops, ensuring a much more accurate
+representation of offload activity for power management.
+
+Cc: stable <stable@kernel.org>
+Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage")
+Signed-off-by: Guan-Yu Lin <guanyulin@google.com>
+Tested-by: Hailong Liu <hailong.liu@oppo.com>
+Tested-by: hailong.liu@oppo.com
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20260401123238.3790062-3-guanyulin@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-sideband.c | 14 +-------------
+ sound/usb/qcom/qc_audio_offload.c | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 14 deletions(-)
+
+--- a/drivers/usb/host/xhci-sideband.c
++++ b/drivers/usb/host/xhci-sideband.c
+@@ -93,8 +93,6 @@ __xhci_sideband_remove_endpoint(struct x
+ static void
+ __xhci_sideband_remove_interrupter(struct xhci_sideband *sb)
+ {
+- struct usb_device *udev;
+-
+ lockdep_assert_held(&sb->mutex);
+
+ if (!sb->ir)
+@@ -102,10 +100,6 @@ __xhci_sideband_remove_interrupter(struc
+
+ xhci_remove_secondary_interrupter(xhci_to_hcd(sb->xhci), sb->ir);
+ sb->ir = NULL;
+- udev = sb->vdev->udev;
+-
+- if (udev->state != USB_STATE_NOTATTACHED)
+- usb_offload_put(udev);
+ }
+
+ /* sideband api functions */
+@@ -328,9 +322,6 @@ int
+ xhci_sideband_create_interrupter(struct xhci_sideband *sb, int num_seg,
+ bool ip_autoclear, u32 imod_interval, int intr_num)
+ {
+- int ret = 0;
+- struct usb_device *udev;
+-
+ if (!sb || !sb->xhci)
+ return -ENODEV;
+
+@@ -348,12 +339,9 @@ xhci_sideband_create_interrupter(struct
+ if (!sb->ir)
+ return -ENOMEM;
+
+- udev = sb->vdev->udev;
+- ret = usb_offload_get(udev);
+-
+ sb->ir->ip_autoclear = ip_autoclear;
+
+- return ret;
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(xhci_sideband_create_interrupter);
+
+--- a/sound/usb/qcom/qc_audio_offload.c
++++ b/sound/usb/qcom/qc_audio_offload.c
+@@ -699,6 +699,7 @@ static void uaudio_event_ring_cleanup_fr
+ uaudio_iommu_unmap(MEM_EVENT_RING, IOVA_BASE, PAGE_SIZE,
+ PAGE_SIZE);
+ xhci_sideband_remove_interrupter(uadev[dev->chip->card->number].sb);
++ usb_offload_put(dev->udev);
+ }
+ }
+
+@@ -1182,12 +1183,16 @@ static int uaudio_event_ring_setup(struc
+ dma_coherent = dev_is_dma_coherent(subs->dev->bus->sysdev);
+ er_pa = 0;
+
++ ret = usb_offload_get(subs->dev);
++ if (ret < 0)
++ goto exit;
++
+ /* event ring */
+ ret = xhci_sideband_create_interrupter(uadev[card_num].sb, 1, false,
+ 0, uaudio_qdev->data->intr_num);
+ if (ret < 0) {
+ dev_err(&subs->dev->dev, "failed to fetch interrupter\n");
+- goto exit;
++ goto put_offload;
+ }
+
+ sgt = xhci_sideband_get_event_buffer(uadev[card_num].sb);
+@@ -1219,6 +1224,8 @@ clear_pa:
+ mem_info->dma = 0;
+ remove_interrupter:
+ xhci_sideband_remove_interrupter(uadev[card_num].sb);
++put_offload:
++ usb_offload_put(subs->dev);
+ exit:
+ return ret;
+ }
+@@ -1483,6 +1490,7 @@ unmap_er:
+ uaudio_iommu_unmap(MEM_EVENT_RING, IOVA_BASE, PAGE_SIZE, PAGE_SIZE);
+ free_sec_ring:
+ xhci_sideband_remove_interrupter(uadev[card_num].sb);
++ usb_offload_put(subs->dev);
+ drop_sync_ep:
+ if (subs->sync_endpoint) {
+ uaudio_iommu_unmap(MEM_XFER_RING,
--- /dev/null
+From 33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21 Mon Sep 17 00:00:00 2001
+From: Felix Gu <ustc.gu@gmail.com>
+Date: Tue, 31 Mar 2026 20:05:08 +0800
+Subject: usb: misc: usbio: Fix URB memory leak on submit failure
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+commit 33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21 upstream.
+
+When usb_submit_urb() fails in usbio_probe(), the previously allocated
+URB is never freed, causing a memory leak.
+
+Fix this by jumping to err_free_urb label to properly release the URB
+on the error path.
+
+Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Oliver Neukum <oneukum@suse.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/usbio.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/misc/usbio.c
++++ b/drivers/usb/misc/usbio.c
+@@ -614,8 +614,10 @@ static int usbio_probe(struct usb_interf
+ usb_fill_bulk_urb(usbio->urb, udev, usbio->rx_pipe, usbio->rxbuf,
+ usbio->rxbuf_len, usbio_bulk_recv, usbio);
+ ret = usb_submit_urb(usbio->urb, GFP_KERNEL);
+- if (ret)
+- return dev_err_probe(dev, ret, "Submitting usb urb\n");
++ if (ret) {
++ dev_err_probe(dev, ret, "Submitting usb urb\n");
++ goto err_free_urb;
++ }
+
+ mutex_lock(&usbio->ctrl_mutex);
+
+@@ -663,6 +665,7 @@ static int usbio_probe(struct usb_interf
+ err_unlock:
+ mutex_unlock(&usbio->ctrl_mutex);
+ usb_kill_urb(usbio->urb);
++err_free_urb:
+ usb_free_urb(usbio->urb);
+
+ return ret;
--- /dev/null
+From dd36014ec6042f424ef51b923e607772f7502ee7 Mon Sep 17 00:00:00 2001
+From: Miao Li <limiao@kylinos.cn>
+Date: Thu, 19 Mar 2026 13:39:27 +0800
+Subject: usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
+
+From: Miao Li <limiao@kylinos.cn>
+
+commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream.
+
+Another Silicon Motion flash drive also randomly work incorrectly
+(lsusb does not list the device) on Huawei hisi platforms during
+500 reboot cycles, and the DELAY_INIT quirk fixes this issue.
+
+Signed-off-by: Miao Li <limiao@kylinos.cn>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -402,6 +402,7 @@ static const struct usb_device_id usb_qu
+
+ /* Silicon Motion Flash Drive */
+ { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Sound Devices USBPre2 */
+ { USB_DEVICE(0x0926, 0x0202), .driver_info =
--- /dev/null
+From 01af542392b5d41fd659d487015a71f627accce3 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Wed, 1 Apr 2026 10:51:42 +0800
+Subject: usb: ulpi: fix double free in ulpi_register_interface() error path
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 01af542392b5d41fd659d487015a71f627accce3 upstream.
+
+When device_register() fails, ulpi_register() calls put_device() on
+ulpi->dev.
+
+The device release callback ulpi_dev_release() drops the OF node
+reference and frees ulpi, but the current error path in
+ulpi_register_interface() then calls kfree(ulpi) again, causing a
+double free.
+
+Let put_device() handle the cleanup through ulpi_dev_release() and
+avoid freeing ulpi again in ulpi_register_interface().
+
+Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/common/ulpi.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(str
+ ulpi->ops = ops;
+
+ ret = ulpi_register(dev, ulpi);
+- if (ret) {
+- kfree(ulpi);
++ if (ret)
+ return ERR_PTR(ret);
+- }
++
+
+ return ulpi;
+ }
--- /dev/null
+From 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Mon Sep 17 00:00:00 2001
+From: Heitor Alves de Siqueira <halves@igalia.com>
+Date: Thu, 12 Mar 2026 09:27:28 -0300
+Subject: usb: usbtmc: Flush anchored URBs in usbtmc_release
+
+From: Heitor Alves de Siqueira <halves@igalia.com>
+
+commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream.
+
+When calling usbtmc_release, pending anchored URBs must be flushed or
+killed to prevent use-after-free errors (e.g. in the HCD giveback
+path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
+
+Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file")
+Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f
+Cc: stable <stable@kernel.org>
+Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
+Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/usbtmc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode *
+ list_del(&file_data->file_elem);
+
+ spin_unlock_irq(&file_data->data->dev_lock);
++
++ /* flush anchored URBs */
++ usbtmc_draw_down(file_data);
+ mutex_unlock(&file_data->data->io_mutex);
+
+ kref_put(&file_data->data->kref, usbtmc_delete);
projects / thirdparty / kernel / stable-queue.git / commitdiff
