--- /dev/null
+From c354521708175d776d896f8bdae44b18711eccb6 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Thu, 12 Mar 2026 13:20:24 +0200
+Subject: iio: dac: ad5770r: fix error return in ad5770r_read_raw()
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit c354521708175d776d896f8bdae44b18711eccb6 upstream.
+
+Return the error code from regmap_bulk_read() instead of 0 so
+that I/O failures are properly propagated.
+
+Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5770r.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ad5770r.c
++++ b/drivers/iio/dac/ad5770r.c
+@@ -323,7 +323,7 @@ static int ad5770r_read_raw(struct iio_d
+ chan->address,
+ st->transf_buf, 2);
+ if (ret)
+- return 0;
++ return ret;
+
+ buf16 = st->transf_buf[0] + (st->transf_buf[1] << 8);
+ *val = buf16 >> 2;
--- /dev/null
+From edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:15 -0600
+Subject: iio: gyro: mpu3050: Fix incorrect free_irq() variable
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream.
+
+The handler for the IRQ part of this driver is mpu3050->trig but,
+in the teardown free_irq() is called with handler mpu3050.
+
+Use correct IRQ handler when calling free_irq().
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1278,7 +1278,7 @@ int mpu3050_common_remove(struct device
+ pm_runtime_disable(dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+- free_irq(mpu3050->irq, mpu3050);
++ free_irq(mpu3050->irq, mpu3050->trig);
+ iio_device_unregister(indio_dev);
+ mpu3050_power_down(mpu3050);
+
--- /dev/null
+From 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:16 -0600
+Subject: iio: gyro: mpu3050: Fix irq resource leak
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream.
+
+The interrupt handler is setup but only a few lines down if
+iio_trigger_register() fails the function returns without properly
+releasing the handler.
+
+Add cleanup goto to resolve resource leak.
+
+Detected by Smatch:
+drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
+'irq' from request_threaded_irq() not released on lines: 1124.
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1137,11 +1137,16 @@ static int mpu3050_trigger_probe(struct
+
+ ret = iio_trigger_register(mpu3050->trig);
+ if (ret)
+- return ret;
++ goto err_iio_trigger;
+
+ indio_dev->trig = iio_trigger_get(mpu3050->trig);
+
+ return 0;
++
++err_iio_trigger:
++ free_irq(mpu3050->irq, mpu3050->trig);
++
++ return ret;
+ }
+
+ int mpu3050_common_probe(struct device *dev,
--- /dev/null
+From d14116f6529fa085b1a1b1f224dc9604e4d2a29c Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:18 -0600
+Subject: iio: gyro: mpu3050: Fix out-of-sequence free_irq()
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream.
+
+The triggered buffer is initialized before the IRQ is requested. The
+removal path currently calls iio_triggered_buffer_cleanup() before
+free_irq(). This violates the expected LIFO.
+
+Place free_irq() in the correct location relative to
+iio_triggered_buffer_cleanup().
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1287,9 +1287,9 @@ int mpu3050_common_remove(struct device
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+- iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
++ iio_triggered_buffer_cleanup(indio_dev);
+ mpu3050_power_down(mpu3050);
+
+ return 0;
--- /dev/null
+From 4c05799449108fb0e0a6bd30e65fffc71e60db4d Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:17 -0600
+Subject: iio: gyro: mpu3050: Move iio_device_register() to correct location
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream.
+
+iio_device_register() should be at the end of the probe function to
+prevent race conditions.
+
+Place iio_device_register() at the end of the probe function and place
+iio_device_unregister() accordingly.
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1234,12 +1234,6 @@ int mpu3050_common_probe(struct device *
+ goto err_power_down;
+ }
+
+- ret = iio_device_register(indio_dev);
+- if (ret) {
+- dev_err(dev, "device register failed\n");
+- goto err_cleanup_buffer;
+- }
+-
+ dev_set_drvdata(dev, indio_dev);
+
+ /* Check if we have an assigned IRQ to use as trigger */
+@@ -1262,9 +1256,20 @@ int mpu3050_common_probe(struct device *
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_put(dev);
+
++ ret = iio_device_register(indio_dev);
++ if (ret) {
++ dev_err(dev, "device register failed\n");
++ goto err_iio_device_register;
++ }
++
+ return 0;
+
+-err_cleanup_buffer:
++err_iio_device_register:
++ pm_runtime_get_sync(dev);
++ pm_runtime_put_noidle(dev);
++ pm_runtime_disable(dev);
++ if (irq)
++ free_irq(mpu3050->irq, mpu3050->trig);
+ iio_triggered_buffer_cleanup(indio_dev);
+ err_power_down:
+ mpu3050_power_down(mpu3050);
+@@ -1278,13 +1283,13 @@ int mpu3050_common_remove(struct device
+ struct iio_dev *indio_dev = dev_get_drvdata(dev);
+ struct mpu3050 *mpu3050 = iio_priv(indio_dev);
+
++ iio_device_unregister(indio_dev);
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
+- iio_device_unregister(indio_dev);
+ mpu3050_power_down(mpu3050);
+
+ return 0;
--- /dev/null
+From 630748afa7030b272b7bee5df857e7bcf132ed51 Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <flavra@baylibre.com>
+Date: Wed, 25 Feb 2026 11:06:00 +0100
+Subject: iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
+
+From: Francesco Lavra <flavra@baylibre.com>
+
+commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream.
+
+The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and
+disabling the hardware FIFO, checks the contents of the hw->settings->batch
+array at index sensor->id, and then sets the current ODR value in sensor
+registers that depend on whether the register address is set in the above
+array element. This logic is valid for internal sensors only, i.e. the
+accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu:
+st_lsm6dsx: add i2c embedded controller support"), this function is called
+also when configuring the hardware FIFO for external sensors (i.e. sensors
+accessed through the sensor hub functionality), which can result in
+unrelated device registers being written.
+
+Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does
+not touch any registers unless it is called for internal sensors.
+
+Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
+Signed-off-by: Francesco Lavra <flavra@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+@@ -201,6 +201,10 @@ static int st_lsm6dsx_set_fifo_odr(struc
+ const struct st_lsm6dsx_reg *batch_reg;
+ u8 data;
+
++ /* Only internal sensors have a FIFO ODR configuration register. */
++ if (sensor->id >= ARRAY_SIZE(hw->settings->batch))
++ return 0;
++
+ batch_reg = &hw->settings->batch[sensor->id];
+ if (batch_reg->addr) {
+ int val;
--- /dev/null
+From fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Sat, 14 Mar 2026 17:18:10 -0500
+Subject: iio: light: vcnl4035: fix scan buffer on big-endian
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream.
+
+Rework vcnl4035_trigger_consumer_handler() so that we are not passing
+what should be a u16 value as an int * to regmap_read(). This won't
+work on bit endian systems.
+
+Instead, add a new unsigned int variable to pass to regmap_read(). Then
+copy that value into the buffer struct.
+
+The buffer array is replaced with a struct since there is only one value
+being read. This allows us to use the correct u16 data type and has a
+side-effect of simplifying the alignment specification.
+
+Also fix the endianness of the scan format from little-endian to CPU
+endianness. Since we are using regmap to read the value, it will be
+CPU-endian.
+
+Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/vcnl4035.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/light/vcnl4035.c
++++ b/drivers/iio/light/vcnl4035.c
+@@ -105,17 +105,23 @@ static irqreturn_t vcnl4035_trigger_cons
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct vcnl4035_data *data = iio_priv(indio_dev);
+ /* Ensure naturally aligned timestamp */
+- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { };
++ struct {
++ u16 als_data;
++ aligned_s64 timestamp;
++ } buffer = { };
++ unsigned int val;
+ int ret;
+
+- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer);
++ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val);
+ if (ret < 0) {
+ dev_err(&data->client->dev,
+ "Trigger consumer can't read from sensor.\n");
+ goto fail_read;
+ }
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+- iio_get_time_ns(indio_dev));
++
++ buffer.als_data = val;
++ iio_push_to_buffers_with_timestamp(indio_dev, &buffer,
++ iio_get_time_ns(indio_dev));
+
+ fail_read:
+ iio_trigger_notify_done(indio_dev->trig);
+@@ -380,7 +386,7 @@ static const struct iio_chan_spec vcnl40
+ .sign = 'u',
+ .realbits = 16,
+ .storagebits = 16,
+- .endianness = IIO_LE,
++ .endianness = IIO_CPU,
+ },
+ },
+ {
+@@ -394,7 +400,7 @@ static const struct iio_chan_spec vcnl40
+ .sign = 'u',
+ .realbits = 16,
+ .storagebits = 16,
+- .endianness = IIO_LE,
++ .endianness = IIO_CPU,
+ },
+ },
+ };
--- /dev/null
+From 5839419cffc7788a356428d321e3ec18055c0286 Mon Sep 17 00:00:00 2001
+From: Christoffer Sandberg <cs@tuxedo.de>
+Date: Mon, 23 Feb 2026 15:20:45 +0100
+Subject: Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+commit 5839419cffc7788a356428d321e3ec18055c0286 upstream.
+
+The device occasionally wakes up from suspend with missing input on the
+internal keyboard and the following suspend attempt results in an instant
+wake-up. The quirks fix both issues for this device.
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
--- /dev/null
+From 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 23 Feb 2026 15:05:15 -0800
+Subject: Input: synaptics-rmi4 - fix a locking bug in an error path
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream.
+
+Lock f54->data_mutex when entering the function statement since jumping
+to the 'error' label when checking report_size fails causes that mutex
+to be unlocked.
+
+This bug has been detected by the Clang thread-safety checker.
+
+Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/rmi4/rmi_f54.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_f54.c
++++ b/drivers/input/rmi4/rmi_f54.c
+@@ -534,6 +534,8 @@ static void rmi_f54_work(struct work_str
+ int error;
+ int i;
+
++ mutex_lock(&f54->data_mutex);
++
+ report_size = rmi_f54_get_report_size(f54);
+ if (report_size == 0) {
+ dev_err(&fn->dev, "Bad report size, report type=%d\n",
+@@ -542,8 +544,6 @@ static void rmi_f54_work(struct work_str
+ goto error; /* retry won't help */
+ }
+
+- mutex_lock(&f54->data_mutex);
+-
+ /*
+ * Need to check if command has completed.
+ * If not try again later.
--- /dev/null
+From e2b0ae529db4766584e77647cefe3ec15c3d842e Mon Sep 17 00:00:00 2001
+From: Zoltan Illes <zoliviragh@gmail.com>
+Date: Fri, 3 Apr 2026 22:03:42 -0700
+Subject: Input: xpad - add support for Razer Wolverine V3 Pro
+
+From: Zoltan Illes <zoliviragh@gmail.com>
+
+commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream.
+
+Add device IDs for the Razer Wolverine V3 Pro controller in both
+wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.
+
+The controller uses the Xbox 360 protocol (vendor-specific class,
+subclass 93, protocol 1) on interface 0 with an identical 20-byte
+input report layout, so no additional processing is needed.
+
+Signed-off-by: Zoltan Illes <zoliviragh@gmail.com>
+Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -269,6 +269,8 @@ static const struct xpad_device {
+ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
++ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 },
++ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch
usb-serial-option-add-support-for-rolling-wireless-rw135r-gl.patch
usb-core-add-no_lpm-quirk-for-razer-kiyo-pro-webcam.patch
+input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch
+input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch
+input-xpad-add-support-for-razer-wolverine-v3-pro.patch
+iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch
+iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch
+iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch
+iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch
+iio-gyro-mpu3050-fix-irq-resource-leak.patch
+iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch
+iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch
+usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch
+usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch
+usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch
+usb-ehci-brcm-fix-sleep-during-atomic.patch
--- /dev/null
+From 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Mon Sep 17 00:00:00 2001
+From: Justin Chen <justin.chen@broadcom.com>
+Date: Wed, 18 Mar 2026 11:57:07 -0700
+Subject: usb: ehci-brcm: fix sleep during atomic
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream.
+
+echi_brcm_wait_for_sof() gets called after disabling interrupts
+in ehci_brcm_hub_control(). Use the atomic version of poll_timeout
+to fix the warning.
+
+Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ehci-brcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-brcm.c
++++ b/drivers/usb/host/ehci-brcm.c
+@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so
+ int res;
+
+ /* Wait for next microframe (every 125 usecs) */
+- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val,
+- val != frame_idx, 1, 130);
++ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index,
++ val, val != frame_idx, 1, 130);
+ if (res)
+ ehci_err(ehci, "Error waiting for SOF\n");
+ udelay(delay);
--- /dev/null
+From dd36014ec6042f424ef51b923e607772f7502ee7 Mon Sep 17 00:00:00 2001
+From: Miao Li <limiao@kylinos.cn>
+Date: Thu, 19 Mar 2026 13:39:27 +0800
+Subject: usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
+
+From: Miao Li <limiao@kylinos.cn>
+
+commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream.
+
+Another Silicon Motion flash drive also randomly work incorrectly
+(lsusb does not list the device) on Huawei hisi platforms during
+500 reboot cycles, and the DELAY_INIT quirk fixes this issue.
+
+Signed-off-by: Miao Li <limiao@kylinos.cn>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -394,6 +394,7 @@ static const struct usb_device_id usb_qu
+
+ /* Silicon Motion Flash Drive */
+ { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Sound Devices USBPre2 */
+ { USB_DEVICE(0x0926, 0x0202), .driver_info =
--- /dev/null
+From 01af542392b5d41fd659d487015a71f627accce3 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Wed, 1 Apr 2026 10:51:42 +0800
+Subject: usb: ulpi: fix double free in ulpi_register_interface() error path
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 01af542392b5d41fd659d487015a71f627accce3 upstream.
+
+When device_register() fails, ulpi_register() calls put_device() on
+ulpi->dev.
+
+The device release callback ulpi_dev_release() drops the OF node
+reference and frees ulpi, but the current error path in
+ulpi_register_interface() then calls kfree(ulpi) again, causing a
+double free.
+
+Let put_device() handle the cleanup through ulpi_dev_release() and
+avoid freeing ulpi again in ulpi_register_interface().
+
+Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/common/ulpi.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(str
+ ulpi->ops = ops;
+
+ ret = ulpi_register(dev, ulpi);
+- if (ret) {
+- kfree(ulpi);
++ if (ret)
+ return ERR_PTR(ret);
+- }
++
+
+ return ulpi;
+ }
--- /dev/null
+From 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Mon Sep 17 00:00:00 2001
+From: Heitor Alves de Siqueira <halves@igalia.com>
+Date: Thu, 12 Mar 2026 09:27:28 -0300
+Subject: usb: usbtmc: Flush anchored URBs in usbtmc_release
+
+From: Heitor Alves de Siqueira <halves@igalia.com>
+
+commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream.
+
+When calling usbtmc_release, pending anchored URBs must be flushed or
+killed to prevent use-after-free errors (e.g. in the HCD giveback
+path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
+
+Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file")
+Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f
+Cc: stable <stable@kernel.org>
+Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
+Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/usbtmc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode *
+ list_del(&file_data->file_elem);
+
+ spin_unlock_irq(&file_data->data->dev_lock);
++
++ /* flush anchored URBs */
++ usbtmc_draw_down(file_data);
+ mutex_unlock(&file_data->data->io_mutex);
+
+ kref_put(&file_data->data->kref, usbtmc_delete);
projects / thirdparty / kernel / stable-queue.git / commitdiff
