From: Greg Kroah-Hartman Date: Tue, 7 Apr 2026 15:34:35 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a104b437ff4909ab47c8ae171e55264980078077;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: gpib-lpvo_usb-fix-memory-leak-on-disconnect.patch iio-accel-adxl313-add-missing-error-check-in-predisable.patch iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch iio-accel-fix-adxl355-temperature-signature-value.patch iio-adc-ade9000-fix-wrong-register-in-calibbias-case-for-active-power.patch iio-adc-ade9000-fix-wrong-return-type-in-streaming-push.patch iio-adc-ade9000-move-mutex-init-before-irq-registration.patch iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch iio-adc-ti-ads7950-do-not-clobber-gpio-state-in-ti_ads7950_get.patch iio-adc-ti-ads7950-normalize-return-value-of-gpio_get.patch iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch iio-gyro-mpu3050-fix-irq-resource-leak.patch iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch iio-imu-adis16550-fix-swapped-gyro-accel-filter-functions.patch iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch iio-light-veml6070-fix-veml6070_read-return-value.patch input-bcm5974-recover-from-failed-mode-switch.patch input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch input-xpad-add-support-for-razer-wolverine-v3-pro.patch mei-me-reduce-the-scope-on-unexpected-reset.patch usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch usb-core-phy-avoid-double-use-of-usb3-phy.patch usb-core-use-dedicated-spinlock-for-offload-state.patch usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch usb-ehci-brcm-fix-sleep-during-atomic.patch usb-host-xhci-sideband-delegate-offload_usage-tracking-to-class-drivers.patch usb-misc-usbio-fix-urb-memory-leak-on-submit-failure.patch usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch --- diff --git a/queue-6.18/gpib-lpvo_usb-fix-memory-leak-on-disconnect.patch b/queue-6.18/gpib-lpvo_usb-fix-memory-leak-on-disconnect.patch new file mode 100644 index 0000000000..b57f312fcf --- /dev/null +++ b/queue-6.18/gpib-lpvo_usb-fix-memory-leak-on-disconnect.patch @@ -0,0 +1,46 @@ +From 5cefb52c1af6f69ea719e42788f6ec6a087eb74c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Mar 2026 11:51:27 +0100 +Subject: gpib: lpvo_usb: fix memory leak on disconnect + +From: Johan Hovold + +commit 5cefb52c1af6f69ea719e42788f6ec6a087eb74c upstream. + +The driver iterates over the registered USB interfaces during GPIB +attach and takes a reference to their USB devices until a match is +found. These references are never released which leads to a memory leak +when devices are disconnected. + +Fix the leak by dropping the unnecessary references. + +Fixes: fce79512a96a ("staging: gpib: Add LPVO DIY USB GPIB driver") +Cc: stable # 6.13 +Cc: Dave Penkler +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260310105127.17538-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c ++++ b/drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c +@@ -405,7 +405,7 @@ static int usb_gpib_attach(struct gpib_b + for (j = 0 ; j < MAX_DEV ; j++) { + if ((assigned_usb_minors & 1 << j) == 0) + continue; +- udev = usb_get_dev(interface_to_usbdev(lpvo_usb_interfaces[j])); ++ udev = interface_to_usbdev(lpvo_usb_interfaces[j]); + device_path = kobject_get_path(&udev->dev.kobj, GFP_KERNEL); + match = gpib_match_device_path(&lpvo_usb_interfaces[j]->dev, + config->device_path); +@@ -420,7 +420,7 @@ static int usb_gpib_attach(struct gpib_b + for (j = 0 ; j < MAX_DEV ; j++) { + if ((assigned_usb_minors & 1 << j) == 0) + continue; +- udev = usb_get_dev(interface_to_usbdev(lpvo_usb_interfaces[j])); ++ udev = interface_to_usbdev(lpvo_usb_interfaces[j]); + DIA_LOG(1, "dev. %d: bus %d -> %d dev: %d -> %d\n", j, + udev->bus->busnum, config->pci_bus, udev->devnum, config->pci_slot); + if (config->pci_bus == udev->bus->busnum && diff --git a/queue-6.18/iio-accel-adxl313-add-missing-error-check-in-predisable.patch b/queue-6.18/iio-accel-adxl313-add-missing-error-check-in-predisable.patch new file mode 100644 index 0000000000..c11018df95 --- /dev/null +++ b/queue-6.18/iio-accel-adxl313-add-missing-error-check-in-predisable.patch @@ -0,0 +1,38 @@ +From 9d3fa23d5d55a137fd4396d3d4799102587a7f2b Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Thu, 12 Mar 2026 13:20:23 +0200 +Subject: iio: accel: adxl313: add missing error check in predisable + +From: Antoniu Miclaus + +commit 9d3fa23d5d55a137fd4396d3d4799102587a7f2b upstream. + +Check the return value of the FIFO bypass regmap_write() before +proceeding to disable interrupts. + +Fixes: ff8093fa6ba4 ("iio: accel: adxl313: add buffered FIFO watermark with interrupt handling") +Signed-off-by: Antoniu Miclaus +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/adxl313_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iio/accel/adxl313_core.c b/drivers/iio/accel/adxl313_core.c +index 9f5d4d2cb325..83dcac17a042 100644 +--- a/drivers/iio/accel/adxl313_core.c ++++ b/drivers/iio/accel/adxl313_core.c +@@ -998,6 +998,8 @@ static int adxl313_buffer_predisable(struct iio_dev *indio_dev) + + ret = regmap_write(data->regmap, ADXL313_REG_FIFO_CTL, + FIELD_PREP(ADXL313_REG_FIFO_CTL_MODE_MSK, ADXL313_FIFO_BYPASS)); ++ if (ret) ++ return ret; + + ret = regmap_write(data->regmap, ADXL313_REG_INT_ENABLE, 0); + if (ret) +-- +2.53.0 + diff --git a/queue-6.18/iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch b/queue-6.18/iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch new file mode 100644 index 0000000000..9b0efbf14e --- /dev/null +++ b/queue-6.18/iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch @@ -0,0 +1,33 @@ +From bd66aa1c8b8cabf459064a46d3430a5ec5138418 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Fri, 27 Feb 2026 14:43:05 +0200 +Subject: iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 + +From: Antoniu Miclaus + +commit bd66aa1c8b8cabf459064a46d3430a5ec5138418 upstream. + +FIELD_PREP(BIT(0), fifo_samples & BIT(8)) produces either 0 or 256, +and since FIELD_PREP masks to bit 0, 256 & 1 evaluates to 0. Use !! +to convert the result to a proper 0-or-1 value. + +Fixes: df36de13677a ("iio: accel: add ADXL380 driver") +Signed-off-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/adxl380.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/adxl380.c ++++ b/drivers/iio/accel/adxl380.c +@@ -888,7 +888,7 @@ static int adxl380_set_fifo_samples(stru + ret = regmap_update_bits(st->regmap, ADXL380_FIFO_CONFIG_0_REG, + ADXL380_FIFO_SAMPLES_8_MSK, + FIELD_PREP(ADXL380_FIFO_SAMPLES_8_MSK, +- (fifo_samples & BIT(8)))); ++ !!(fifo_samples & BIT(8)))); + if (ret) + return ret; + diff --git a/queue-6.18/iio-accel-fix-adxl355-temperature-signature-value.patch b/queue-6.18/iio-accel-fix-adxl355-temperature-signature-value.patch new file mode 100644 index 0000000000..c34712d0ae --- /dev/null +++ b/queue-6.18/iio-accel-fix-adxl355-temperature-signature-value.patch @@ -0,0 +1,33 @@ +From 4f51e6c0baae80e52bd013092e82a55678be31fc Mon Sep 17 00:00:00 2001 +From: Valek Andrej +Date: Fri, 13 Mar 2026 10:24:13 +0100 +Subject: iio: accel: fix ADXL355 temperature signature value + +From: Valek Andrej + +commit 4f51e6c0baae80e52bd013092e82a55678be31fc upstream. + +Temperature was wrongly represented as 12-bit signed, confirmed by checking +the datasheet. Even if the temperature is negative, the value in the +register stays unsigned. + +Fixes: 12ed27863ea3 iio: accel: Add driver support for ADXL355 +Signed-off-by: Valek Andrej +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/adxl355_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/adxl355_core.c ++++ b/drivers/iio/accel/adxl355_core.c +@@ -745,7 +745,7 @@ static const struct iio_chan_spec adxl35 + BIT(IIO_CHAN_INFO_OFFSET), + .scan_index = 3, + .scan_type = { +- .sign = 's', ++ .sign = 'u', + .realbits = 12, + .storagebits = 16, + .endianness = IIO_BE, diff --git a/queue-6.18/iio-adc-ade9000-fix-wrong-register-in-calibbias-case-for-active-power.patch b/queue-6.18/iio-adc-ade9000-fix-wrong-register-in-calibbias-case-for-active-power.patch new file mode 100644 index 0000000000..734b050c9d --- /dev/null +++ b/queue-6.18/iio-adc-ade9000-fix-wrong-register-in-calibbias-case-for-active-power.patch @@ -0,0 +1,48 @@ +From 86133fb1ec36b2f5cec29d71fbae84877c3a1358 Mon Sep 17 00:00:00 2001 +From: Giorgi Tchankvetadze +Date: Thu, 26 Feb 2026 18:07:02 +0400 +Subject: iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power + +From: Giorgi Tchankvetadze + +commit 86133fb1ec36b2f5cec29d71fbae84877c3a1358 upstream. + +The switch statement in ade9000_write_raw() attempts to match +chan->address against ADE9000_REG_AWATTOS (0x00F) to dispatch +the calibration offset write for active power channels. However, +chan->address is set via ADE9000_ADDR_ADJUST(ADE9000_REG_AWATT, +num), so after masking the phase bits, tmp holds +ADE9000_REG_AWATT (0x210), which never matches 0x00F. + +As a result, writing IIO_CHAN_INFO_CALIBBIAS for IIO_POWER always +falls through to the default case and returns -EINVAL, making +active power offset calibration silently broken. + +Fix this by matching against ADE9000_REG_AWATT instead, which is +the actual base address stored in chan->address for watt channels. + +Reference:ADE9000 datasheet (Rev. B), AWATTOS is the offset correction +register at 0x00F (p. 44), while AWATT is the total active power +register at 0x210 (p. 48). + +Fixes: 81de7b4619fc ("iio: adc: add ade9000 support") +Signed-off-by: Giorgi Tchankvetadze +Reviewed-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ade9000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ade9000.c ++++ b/drivers/iio/adc/ade9000.c +@@ -1123,7 +1123,7 @@ static int ade9000_write_raw(struct iio_ + tmp &= ~ADE9000_PHASE_C_POS_BIT; + + switch (tmp) { +- case ADE9000_REG_AWATTOS: ++ case ADE9000_REG_AWATT: + return regmap_write(st->regmap, + ADE9000_ADDR_ADJUST(ADE9000_REG_AWATTOS, + chan->channel), val); diff --git a/queue-6.18/iio-adc-ade9000-fix-wrong-return-type-in-streaming-push.patch b/queue-6.18/iio-adc-ade9000-fix-wrong-return-type-in-streaming-push.patch new file mode 100644 index 0000000000..ac65901ef7 --- /dev/null +++ b/queue-6.18/iio-adc-ade9000-fix-wrong-return-type-in-streaming-push.patch @@ -0,0 +1,43 @@ +From 57b207e38d414a27fda9fff638a0d3e7ef16b917 Mon Sep 17 00:00:00 2001 +From: Giorgi Tchankvetadze +Date: Tue, 24 Feb 2026 17:23:55 +0400 +Subject: iio: adc: ade9000: fix wrong return type in streaming push + +From: Giorgi Tchankvetadze + +commit 57b207e38d414a27fda9fff638a0d3e7ef16b917 upstream. + +The else branch of ade9000_iio_push_streaming() incorrectly returns +IRQ_HANDLED on regmap_write failure. This function returns int (0 on +success, negative errno on failure), so IRQ_HANDLED (1) would be +misinterpreted as a non-error by callers. + +Return ret instead, consistent with every other error path in the +function. + +Fixes: 81de7b4619fc ("iio: adc: add ade9000 support") +Signed-off-by: Giorgi Tchankvetadze +Reviewed-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ade9000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ade9000.c b/drivers/iio/adc/ade9000.c +index 945a159e5de6..1abbfdfcd554 100644 +--- a/drivers/iio/adc/ade9000.c ++++ b/drivers/iio/adc/ade9000.c +@@ -787,7 +787,7 @@ static int ade9000_iio_push_streaming(struct iio_dev *indio_dev) + ADE9000_MIDDLE_PAGE_BIT); + if (ret) { + dev_err_ratelimited(dev, "IRQ0 WFB write fail"); +- return IRQ_HANDLED; ++ return ret; + } + + ade9000_configure_scan(indio_dev, ADE9000_REG_WF_BUFF); +-- +2.53.0 + diff --git a/queue-6.18/iio-adc-ade9000-move-mutex-init-before-irq-registration.patch b/queue-6.18/iio-adc-ade9000-move-mutex-init-before-irq-registration.patch new file mode 100644 index 0000000000..ef67b83edc --- /dev/null +++ b/queue-6.18/iio-adc-ade9000-move-mutex-init-before-irq-registration.patch @@ -0,0 +1,51 @@ +From 0206dd36418c104c0b3dea4ed7047e21eccb30b0 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Fri, 27 Feb 2026 15:33:30 +0200 +Subject: iio: adc: ade9000: move mutex init before IRQ registration + +From: Antoniu Miclaus + +commit 0206dd36418c104c0b3dea4ed7047e21eccb30b0 upstream. + +Move devm_mutex_init() before ade9000_request_irq() calls so that +st->lock is initialized before any handler that depends on it can run. + +Fixes: 81de7b4619fc ("iio: adc: add ade9000 support") +Signed-off-by: Antoniu Miclaus +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ade9000.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/ade9000.c b/drivers/iio/adc/ade9000.c +index db085dc5e526..c62c6480dd0a 100644 +--- a/drivers/iio/adc/ade9000.c ++++ b/drivers/iio/adc/ade9000.c +@@ -1706,6 +1706,10 @@ static int ade9000_probe(struct spi_device *spi) + + init_completion(&st->reset_completion); + ++ ret = devm_mutex_init(dev, &st->lock); ++ if (ret) ++ return ret; ++ + ret = ade9000_request_irq(dev, "irq0", ade9000_irq0_thread, indio_dev); + if (ret) + return ret; +@@ -1718,10 +1722,6 @@ static int ade9000_probe(struct spi_device *spi) + if (ret) + return ret; + +- ret = devm_mutex_init(dev, &st->lock); +- if (ret) +- return ret; +- + /* External CMOS clock input (optional - crystal can be used instead) */ + st->clkin = devm_clk_get_optional_enabled(dev, NULL); + if (IS_ERR(st->clkin)) +-- +2.53.0 + diff --git a/queue-6.18/iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch b/queue-6.18/iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch new file mode 100644 index 0000000000..08cc7ab3bc --- /dev/null +++ b/queue-6.18/iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch @@ -0,0 +1,32 @@ +From 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 Mon Sep 17 00:00:00 2001 +From: Billy Tsai +Date: Tue, 3 Mar 2026 10:38:26 +0800 +Subject: iio: adc: aspeed: clear reference voltage bits before configuring vref + +From: Billy Tsai + +commit 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 upstream. + +Ensures the reference voltage bits are cleared in the ADC engine +control register before configuring the voltage reference. This +avoids potential misconfigurations caused by residual bits. + +Fixes: 1b5ceb55fec2 ("iio: adc: aspeed: Support ast2600 adc.") +Signed-off-by: Billy Tsai +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/aspeed_adc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/aspeed_adc.c ++++ b/drivers/iio/adc/aspeed_adc.c +@@ -415,6 +415,7 @@ static int aspeed_adc_vref_config(struct + } + adc_engine_control_reg_val = + readl(data->base + ASPEED_REG_ENGINE_CONTROL); ++ adc_engine_control_reg_val &= ~ASPEED_ADC_REF_VOLTAGE; + + ret = devm_regulator_get_enable_read_voltage(data->dev, "vref"); + if (ret < 0 && ret != -ENODEV) diff --git a/queue-6.18/iio-adc-ti-ads7950-do-not-clobber-gpio-state-in-ti_ads7950_get.patch b/queue-6.18/iio-adc-ti-ads7950-do-not-clobber-gpio-state-in-ti_ads7950_get.patch new file mode 100644 index 0000000000..ce66c6a7cc --- /dev/null +++ b/queue-6.18/iio-adc-ti-ads7950-do-not-clobber-gpio-state-in-ti_ads7950_get.patch @@ -0,0 +1,61 @@ +From d20bbae6e5d408a8a7c2a4344d76dd1ac557a149 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 5 Mar 2026 11:21:53 -0800 +Subject: iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() + +From: Dmitry Torokhov + +commit d20bbae6e5d408a8a7c2a4344d76dd1ac557a149 upstream. + +GPIO state was inadvertently overwritten by the result of spi_sync(), +resulting in ti_ads7950_get() only returning 0 as GPIO state (or error). + +Fix this by introducing a separate variable to hold the state. + +Fixes: c97dce792dc8 ("iio: adc: ti-ads7950: add GPIO support") +Reported-by: David Lechner +Signed-off-by: Dmitry Torokhov +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-ads7950.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/ti-ads7950.c ++++ b/drivers/iio/adc/ti-ads7950.c +@@ -427,13 +427,15 @@ static int ti_ads7950_set(struct gpio_ch + static int ti_ads7950_get(struct gpio_chip *chip, unsigned int offset) + { + struct ti_ads7950_state *st = gpiochip_get_data(chip); ++ bool state; + int ret; + + mutex_lock(&st->slock); + + /* If set as output, return the output */ + if (st->gpio_cmd_settings_bitmask & BIT(offset)) { +- ret = (st->cmd_settings_bitmask & BIT(offset)) ? 1 : 0; ++ state = st->cmd_settings_bitmask & BIT(offset); ++ ret = 0; + goto out; + } + +@@ -444,7 +446,7 @@ static int ti_ads7950_get(struct gpio_ch + if (ret) + goto out; + +- ret = ((st->single_rx >> 12) & BIT(offset)) ? 1 : 0; ++ state = (st->single_rx >> 12) & BIT(offset); + + /* Revert back to original settings */ + st->cmd_settings_bitmask &= ~TI_ADS7950_CR_GPIO_DATA; +@@ -456,7 +458,7 @@ static int ti_ads7950_get(struct gpio_ch + out: + mutex_unlock(&st->slock); + +- return ret; ++ return ret ?: state; + } + + static int ti_ads7950_get_direction(struct gpio_chip *chip, diff --git a/queue-6.18/iio-adc-ti-ads7950-normalize-return-value-of-gpio_get.patch b/queue-6.18/iio-adc-ti-ads7950-normalize-return-value-of-gpio_get.patch new file mode 100644 index 0000000000..92da5b67aa --- /dev/null +++ b/queue-6.18/iio-adc-ti-ads7950-normalize-return-value-of-gpio_get.patch @@ -0,0 +1,36 @@ +From e2fa075d5ce1963e7cb7b0ac708ba567e5af66db Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 5 Mar 2026 11:21:52 -0800 +Subject: iio: adc: ti-ads7950: normalize return value of gpio_get + +From: Dmitry Torokhov + +commit e2fa075d5ce1963e7cb7b0ac708ba567e5af66db upstream. + +The GPIO get callback is expected to return 0 or 1 (or a negative error +code). Ensure that the value returned by ti_ads7950_get() for output +pins is normalized to the [0, 1] range. + +Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") +Reviewed-by: Andy Shevchenko +Reviewed-by: Bartosz Golaszewski +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Torokhov +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-ads7950.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ti-ads7950.c ++++ b/drivers/iio/adc/ti-ads7950.c +@@ -433,7 +433,7 @@ static int ti_ads7950_get(struct gpio_ch + + /* If set as output, return the output */ + if (st->gpio_cmd_settings_bitmask & BIT(offset)) { +- ret = st->cmd_settings_bitmask & BIT(offset); ++ ret = (st->cmd_settings_bitmask & BIT(offset)) ? 1 : 0; + goto out; + } + diff --git a/queue-6.18/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch b/queue-6.18/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch new file mode 100644 index 0000000000..bd04ac325a --- /dev/null +++ b/queue-6.18/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch @@ -0,0 +1,32 @@ +From c354521708175d776d896f8bdae44b18711eccb6 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Thu, 12 Mar 2026 13:20:24 +0200 +Subject: iio: dac: ad5770r: fix error return in ad5770r_read_raw() + +From: Antoniu Miclaus + +commit c354521708175d776d896f8bdae44b18711eccb6 upstream. + +Return the error code from regmap_bulk_read() instead of 0 so +that I/O failures are properly propagated. + +Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support") +Signed-off-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5770r.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5770r.c ++++ b/drivers/iio/dac/ad5770r.c +@@ -322,7 +322,7 @@ static int ad5770r_read_raw(struct iio_d + chan->address, + st->transf_buf, 2); + if (ret) +- return 0; ++ return ret; + + buf16 = get_unaligned_le16(st->transf_buf); + *val = buf16 >> 2; diff --git a/queue-6.18/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch b/queue-6.18/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch new file mode 100644 index 0000000000..ee29dd0628 --- /dev/null +++ b/queue-6.18/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch @@ -0,0 +1,36 @@ +From edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:15 -0600 +Subject: iio: gyro: mpu3050: Fix incorrect free_irq() variable + +From: Ethan Tidmore + +commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream. + +The handler for the IRQ part of this driver is mpu3050->trig but, +in the teardown free_irq() is called with handler mpu3050. + +Use correct IRQ handler when calling free_irq(). + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1269,7 +1269,7 @@ void mpu3050_common_remove(struct device + pm_runtime_disable(dev); + iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) +- free_irq(mpu3050->irq, mpu3050); ++ free_irq(mpu3050->irq, mpu3050->trig); + iio_device_unregister(indio_dev); + mpu3050_power_down(mpu3050); + } diff --git a/queue-6.18/iio-gyro-mpu3050-fix-irq-resource-leak.patch b/queue-6.18/iio-gyro-mpu3050-fix-irq-resource-leak.patch new file mode 100644 index 0000000000..69d1b6e236 --- /dev/null +++ b/queue-6.18/iio-gyro-mpu3050-fix-irq-resource-leak.patch @@ -0,0 +1,50 @@ +From 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:16 -0600 +Subject: iio: gyro: mpu3050: Fix irq resource leak + +From: Ethan Tidmore + +commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream. + +The interrupt handler is setup but only a few lines down if +iio_trigger_register() fails the function returns without properly +releasing the handler. + +Add cleanup goto to resolve resource leak. + +Detected by Smatch: +drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn: +'irq' from request_threaded_irq() not released on lines: 1124. + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1129,11 +1129,16 @@ static int mpu3050_trigger_probe(struct + + ret = iio_trigger_register(mpu3050->trig); + if (ret) +- return ret; ++ goto err_iio_trigger; + + indio_dev->trig = iio_trigger_get(mpu3050->trig); + + return 0; ++ ++err_iio_trigger: ++ free_irq(mpu3050->irq, mpu3050->trig); ++ ++ return ret; + } + + int mpu3050_common_probe(struct device *dev, diff --git a/queue-6.18/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch b/queue-6.18/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch new file mode 100644 index 0000000000..2fe28173d9 --- /dev/null +++ b/queue-6.18/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch @@ -0,0 +1,41 @@ +From d14116f6529fa085b1a1b1f224dc9604e4d2a29c Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:18 -0600 +Subject: iio: gyro: mpu3050: Fix out-of-sequence free_irq() + +From: Ethan Tidmore + +commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream. + +The triggered buffer is initialized before the IRQ is requested. The +removal path currently calls iio_triggered_buffer_cleanup() before +free_irq(). This violates the expected LIFO. + +Place free_irq() in the correct location relative to +iio_triggered_buffer_cleanup(). + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Suggested-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1278,9 +1278,9 @@ void mpu3050_common_remove(struct device + pm_runtime_get_sync(dev); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); +- iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) + free_irq(mpu3050->irq, mpu3050->trig); ++ iio_triggered_buffer_cleanup(indio_dev); + mpu3050_power_down(mpu3050); + } + diff --git a/queue-6.18/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch b/queue-6.18/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch new file mode 100644 index 0000000000..32e8c41288 --- /dev/null +++ b/queue-6.18/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch @@ -0,0 +1,79 @@ +From 4c05799449108fb0e0a6bd30e65fffc71e60db4d Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:17 -0600 +Subject: iio: gyro: mpu3050: Move iio_device_register() to correct location + +From: Ethan Tidmore + +commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream. + +iio_device_register() should be at the end of the probe function to +prevent race conditions. + +Place iio_device_register() at the end of the probe function and place +iio_device_unregister() accordingly. + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Suggested-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1226,12 +1226,6 @@ int mpu3050_common_probe(struct device * + goto err_power_down; + } + +- ret = iio_device_register(indio_dev); +- if (ret) { +- dev_err(dev, "device register failed\n"); +- goto err_cleanup_buffer; +- } +- + dev_set_drvdata(dev, indio_dev); + + /* Check if we have an assigned IRQ to use as trigger */ +@@ -1254,9 +1248,20 @@ int mpu3050_common_probe(struct device * + pm_runtime_use_autosuspend(dev); + pm_runtime_put(dev); + ++ ret = iio_device_register(indio_dev); ++ if (ret) { ++ dev_err(dev, "device register failed\n"); ++ goto err_iio_device_register; ++ } ++ + return 0; + +-err_cleanup_buffer: ++err_iio_device_register: ++ pm_runtime_get_sync(dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_disable(dev); ++ if (irq) ++ free_irq(mpu3050->irq, mpu3050->trig); + iio_triggered_buffer_cleanup(indio_dev); + err_power_down: + mpu3050_power_down(mpu3050); +@@ -1269,13 +1274,13 @@ void mpu3050_common_remove(struct device + struct iio_dev *indio_dev = dev_get_drvdata(dev); + struct mpu3050 *mpu3050 = iio_priv(indio_dev); + ++ iio_device_unregister(indio_dev); + pm_runtime_get_sync(dev); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); + iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) + free_irq(mpu3050->irq, mpu3050->trig); +- iio_device_unregister(indio_dev); + mpu3050_power_down(mpu3050); + } + diff --git a/queue-6.18/iio-imu-adis16550-fix-swapped-gyro-accel-filter-functions.patch b/queue-6.18/iio-imu-adis16550-fix-swapped-gyro-accel-filter-functions.patch new file mode 100644 index 0000000000..a3adede8e9 --- /dev/null +++ b/queue-6.18/iio-imu-adis16550-fix-swapped-gyro-accel-filter-functions.patch @@ -0,0 +1,52 @@ +From ea7e2e43d768102e2601dbbda42041c78d7a99f9 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Fri, 27 Feb 2026 14:20:46 +0200 +Subject: iio: imu: adis16550: fix swapped gyro/accel filter functions + +From: Antoniu Miclaus + +commit ea7e2e43d768102e2601dbbda42041c78d7a99f9 upstream. + +The low-pass filter handlers for IIO_ANGL_VEL and IIO_ACCEL call each +other's filter functions in both read_raw and write_raw. Swap them so +each channel type uses its correct filter accessor. + +Fixes: bac4368fab62 ("iio: imu: adis16550: add adis16550 support") +Signed-off-by: Antoniu Miclaus +Acked-by: Robert Budai +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/adis16550.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/imu/adis16550.c ++++ b/drivers/iio/imu/adis16550.c +@@ -643,12 +643,12 @@ static int adis16550_read_raw(struct iio + case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY: + switch (chan->type) { + case IIO_ANGL_VEL: +- ret = adis16550_get_accl_filter_freq(st, val); ++ ret = adis16550_get_gyro_filter_freq(st, val); + if (ret) + return ret; + return IIO_VAL_INT; + case IIO_ACCEL: +- ret = adis16550_get_gyro_filter_freq(st, val); ++ ret = adis16550_get_accl_filter_freq(st, val); + if (ret) + return ret; + return IIO_VAL_INT; +@@ -681,9 +681,9 @@ static int adis16550_write_raw(struct ii + case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY: + switch (chan->type) { + case IIO_ANGL_VEL: +- return adis16550_set_accl_filter_freq(st, val); +- case IIO_ACCEL: + return adis16550_set_gyro_filter_freq(st, val); ++ case IIO_ACCEL: ++ return adis16550_set_accl_filter_freq(st, val); + default: + return -EINVAL; + } diff --git a/queue-6.18/iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch b/queue-6.18/iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch new file mode 100644 index 0000000000..0e482a4bd4 --- /dev/null +++ b/queue-6.18/iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch @@ -0,0 +1,76 @@ +From c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Mon, 9 Mar 2026 20:45:45 -0700 +Subject: iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Josh Poimboeuf + +commit c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 upstream. + +If 'pin' is not one of its expected values, the value of +'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes +Clang to generate undefined behavior, resulting in the following +warning: + + drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume() + +Prevent the UB and improve error handling by returning an error if 'pin' +has an unexpected value. + +While at it, simplify the code a bit by moving the 'pin_name' assignment +to the first switch statement. + +Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support") +Reported-by: Arnd Bergmann +Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com +Signed-off-by: Josh Poimboeuf +Reviewed-by: Nuno Sá +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/bmi160/bmi160_core.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +--- a/drivers/iio/imu/bmi160/bmi160_core.c ++++ b/drivers/iio/imu/bmi160/bmi160_core.c +@@ -573,12 +573,16 @@ static int bmi160_config_pin(struct regm + int_out_ctrl_shift = BMI160_INT1_OUT_CTRL_SHIFT; + int_latch_mask = BMI160_INT1_LATCH_MASK; + int_map_mask = BMI160_INT1_MAP_DRDY_EN; ++ pin_name = "INT1"; + break; + case BMI160_PIN_INT2: + int_out_ctrl_shift = BMI160_INT2_OUT_CTRL_SHIFT; + int_latch_mask = BMI160_INT2_LATCH_MASK; + int_map_mask = BMI160_INT2_MAP_DRDY_EN; ++ pin_name = "INT2"; + break; ++ default: ++ return -EINVAL; + } + int_out_ctrl_mask = BMI160_INT_OUT_CTRL_MASK << int_out_ctrl_shift; + +@@ -612,17 +616,8 @@ static int bmi160_config_pin(struct regm + ret = bmi160_write_conf_reg(regmap, BMI160_REG_INT_MAP, + int_map_mask, int_map_mask, + write_usleep); +- if (ret) { +- switch (pin) { +- case BMI160_PIN_INT1: +- pin_name = "INT1"; +- break; +- case BMI160_PIN_INT2: +- pin_name = "INT2"; +- break; +- } ++ if (ret) + dev_err(dev, "Failed to configure %s IRQ pin", pin_name); +- } + + return ret; + } diff --git a/queue-6.18/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch b/queue-6.18/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch new file mode 100644 index 0000000000..b6c5763849 --- /dev/null +++ b/queue-6.18/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch @@ -0,0 +1,45 @@ +From 630748afa7030b272b7bee5df857e7bcf132ed51 Mon Sep 17 00:00:00 2001 +From: Francesco Lavra +Date: Wed, 25 Feb 2026 11:06:00 +0100 +Subject: iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only + +From: Francesco Lavra + +commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream. + +The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and +disabling the hardware FIFO, checks the contents of the hw->settings->batch +array at index sensor->id, and then sets the current ODR value in sensor +registers that depend on whether the register address is set in the above +array element. This logic is valid for internal sensors only, i.e. the +accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu: +st_lsm6dsx: add i2c embedded controller support"), this function is called +also when configuring the hardware FIFO for external sensors (i.e. sensors +accessed through the sensor hub functionality), which can result in +unrelated device registers being written. + +Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does +not touch any registers unless it is called for internal sensors. + +Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") +Signed-off-by: Francesco Lavra +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +@@ -224,6 +224,10 @@ static int st_lsm6dsx_set_fifo_odr(struc + const struct st_lsm6dsx_reg *batch_reg; + u8 data; + ++ /* Only internal sensors have a FIFO ODR configuration register. */ ++ if (sensor->id >= ARRAY_SIZE(hw->settings->batch)) ++ return 0; ++ + batch_reg = &hw->settings->batch[sensor->id]; + if (batch_reg->addr) { + int val; diff --git a/queue-6.18/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch b/queue-6.18/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch new file mode 100644 index 0000000000..640222d285 --- /dev/null +++ b/queue-6.18/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch @@ -0,0 +1,81 @@ +From fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Sat, 14 Mar 2026 17:18:10 -0500 +Subject: iio: light: vcnl4035: fix scan buffer on big-endian + +From: David Lechner + +commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream. + +Rework vcnl4035_trigger_consumer_handler() so that we are not passing +what should be a u16 value as an int * to regmap_read(). This won't +work on bit endian systems. + +Instead, add a new unsigned int variable to pass to regmap_read(). Then +copy that value into the buffer struct. + +The buffer array is replaced with a struct since there is only one value +being read. This allows us to use the correct u16 data type and has a +side-effect of simplifying the alignment specification. + +Also fix the endianness of the scan format from little-endian to CPU +endianness. Since we are using regmap to read the value, it will be +CPU-endian. + +Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") +Signed-off-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/vcnl4035.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -103,17 +103,23 @@ static irqreturn_t vcnl4035_trigger_cons + struct iio_dev *indio_dev = pf->indio_dev; + struct vcnl4035_data *data = iio_priv(indio_dev); + /* Ensure naturally aligned timestamp */ +- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; ++ struct { ++ u16 als_data; ++ aligned_s64 timestamp; ++ } buffer = { }; ++ unsigned int val; + int ret; + +- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); ++ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val); + if (ret < 0) { + dev_err(&data->client->dev, + "Trigger consumer can't read from sensor.\n"); + goto fail_read; + } +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, +- iio_get_time_ns(indio_dev)); ++ ++ buffer.als_data = val; ++ iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ++ iio_get_time_ns(indio_dev)); + + fail_read: + iio_trigger_notify_done(indio_dev->trig); +@@ -381,7 +387,7 @@ static const struct iio_chan_spec vcnl40 + .sign = 'u', + .realbits = 16, + .storagebits = 16, +- .endianness = IIO_LE, ++ .endianness = IIO_CPU, + }, + }, + { +@@ -395,7 +401,7 @@ static const struct iio_chan_spec vcnl40 + .sign = 'u', + .realbits = 16, + .storagebits = 16, +- .endianness = IIO_LE, ++ .endianness = IIO_CPU, + }, + }, + }; diff --git a/queue-6.18/iio-light-veml6070-fix-veml6070_read-return-value.patch b/queue-6.18/iio-light-veml6070-fix-veml6070_read-return-value.patch new file mode 100644 index 0000000000..78e0260e09 --- /dev/null +++ b/queue-6.18/iio-light-veml6070-fix-veml6070_read-return-value.patch @@ -0,0 +1,45 @@ +From d0b224cf9ab12e86a4d1ca55c760dfaa5c19cbe7 Mon Sep 17 00:00:00 2001 +From: Aldo Conte +Date: Wed, 25 Mar 2026 12:32:16 +0100 +Subject: iio: light: veml6070: fix veml6070_read() return value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aldo Conte + +commit d0b224cf9ab12e86a4d1ca55c760dfaa5c19cbe7 upstream. + +veml6070_read() computes the sensor value in ret but +returns 0 instead of the actual result. This causes +veml6070_read_raw() to always report 0. + +Return the computed value instead of 0. + +Running make W=1 returns no errors. I was unable +to test the patch because I do not have the hardware. +Found by code inspection. + +Fixes: fc38525135dd ("iio: light: veml6070: use guard to handle mutex") +Signed-off-by: Aldo Conte +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/veml6070.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/iio/light/veml6070.c ++++ b/drivers/iio/light/veml6070.c +@@ -134,9 +134,7 @@ static int veml6070_read(struct veml6070 + if (ret < 0) + return ret; + +- ret = (msb << 8) | lsb; +- +- return 0; ++ return (msb << 8) | lsb; + } + + static const struct iio_chan_spec veml6070_channels[] = { diff --git a/queue-6.18/input-bcm5974-recover-from-failed-mode-switch.patch b/queue-6.18/input-bcm5974-recover-from-failed-mode-switch.patch new file mode 100644 index 0000000000..8ee702d2eb --- /dev/null +++ b/queue-6.18/input-bcm5974-recover-from-failed-mode-switch.patch @@ -0,0 +1,110 @@ +From fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda Mon Sep 17 00:00:00 2001 +From: Liam Mitchell +Date: Wed, 18 Feb 2026 14:21:35 -0800 +Subject: Input: bcm5974 - recover from failed mode switch + +From: Liam Mitchell + +commit fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda upstream. + +Mode switches sent before control response are ignored. This results in +an unresponsive trackpad and "bcm5974: bad trackpad package, length: 8" +repeated in logs. + +On receiving unknown 8-byte packets, assume that mode switch was ignored +and schedule an asynchronous mode reset. The reset will switch the +device to normal mode, wait, then switch back to wellspring mode. + +Signed-off-by: Liam Mitchell +Link: https://lore.kernel.org/linux-input/CAOQ1CL4+DP1TuLAGNsz5GdFBTHvnTg=5q=Dr2Z1OQc6RXydSYA@mail.gmail.com/ +Acked-by: Henrik Rydberg +Link: https://patch.msgid.link/20260213-bcm5974-reset-v2-1-1837851336b0@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/bcm5974.c | 42 +++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +--- a/drivers/input/mouse/bcm5974.c ++++ b/drivers/input/mouse/bcm5974.c +@@ -286,6 +286,8 @@ struct bcm5974 { + const struct tp_finger *index[MAX_FINGERS]; /* finger index data */ + struct input_mt_pos pos[MAX_FINGERS]; /* position array */ + int slots[MAX_FINGERS]; /* slot assignments */ ++ struct work_struct mode_reset_work; ++ unsigned long last_mode_reset; + }; + + /* trackpad finger block data, le16-aligned */ +@@ -696,6 +698,32 @@ static int bcm5974_wellspring_mode(struc + return retval; + } + ++/* ++ * Mode switches sent before the control response are ignored. ++ * Fixing this state requires switching to normal mode and waiting ++ * about 1ms before switching back to wellspring mode. ++ */ ++static void bcm5974_mode_reset_work(struct work_struct *work) ++{ ++ struct bcm5974 *dev = container_of(work, struct bcm5974, mode_reset_work); ++ int error; ++ ++ guard(mutex)(&dev->pm_mutex); ++ dev->last_mode_reset = jiffies; ++ ++ error = bcm5974_wellspring_mode(dev, false); ++ if (error) { ++ dev_err(&dev->intf->dev, "reset to normal mode failed\n"); ++ return; ++ } ++ ++ fsleep(1000); ++ ++ error = bcm5974_wellspring_mode(dev, true); ++ if (error) ++ dev_err(&dev->intf->dev, "mode switch after reset failed\n"); ++} ++ + static void bcm5974_irq_button(struct urb *urb) + { + struct bcm5974 *dev = urb->context; +@@ -752,10 +780,20 @@ static void bcm5974_irq_trackpad(struct + if (dev->tp_urb->actual_length == 2) + goto exit; + +- if (report_tp_state(dev, dev->tp_urb->actual_length)) ++ if (report_tp_state(dev, dev->tp_urb->actual_length)) { + dprintk(1, "bcm5974: bad trackpad package, length: %d\n", + dev->tp_urb->actual_length); + ++ /* ++ * Receiving a HID packet means we aren't in wellspring mode. ++ * If we haven't tried a reset in the last second, try now. ++ */ ++ if (dev->tp_urb->actual_length == 8 && ++ time_after(jiffies, dev->last_mode_reset + msecs_to_jiffies(1000))) { ++ schedule_work(&dev->mode_reset_work); ++ } ++ } ++ + exit: + error = usb_submit_urb(dev->tp_urb, GFP_ATOMIC); + if (error) +@@ -906,6 +944,7 @@ static int bcm5974_probe(struct usb_inte + dev->intf = iface; + dev->input = input_dev; + dev->cfg = *cfg; ++ INIT_WORK(&dev->mode_reset_work, bcm5974_mode_reset_work); + mutex_init(&dev->pm_mutex); + + /* setup urbs */ +@@ -998,6 +1037,7 @@ static void bcm5974_disconnect(struct us + { + struct bcm5974 *dev = usb_get_intfdata(iface); + ++ disable_work_sync(&dev->mode_reset_work); + usb_set_intfdata(iface, NULL); + + input_unregister_device(dev->input); diff --git a/queue-6.18/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch b/queue-6.18/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch new file mode 100644 index 0000000000..7813647699 --- /dev/null +++ b/queue-6.18/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch @@ -0,0 +1,39 @@ +From 5839419cffc7788a356428d321e3ec18055c0286 Mon Sep 17 00:00:00 2001 +From: Christoffer Sandberg +Date: Mon, 23 Feb 2026 15:20:45 +0100 +Subject: Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table + +From: Christoffer Sandberg + +commit 5839419cffc7788a356428d321e3ec18055c0286 upstream. + +The device occasionally wakes up from suspend with missing input on the +internal keyboard and the following suspend attempt results in an instant +wake-up. The quirks fix both issues for this device. + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_ + }, + { + .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | diff --git a/queue-6.18/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch b/queue-6.18/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch new file mode 100644 index 0000000000..ac6c07a1ab --- /dev/null +++ b/queue-6.18/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch @@ -0,0 +1,45 @@ +From 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 23 Feb 2026 15:05:15 -0800 +Subject: Input: synaptics-rmi4 - fix a locking bug in an error path + +From: Bart Van Assche + +commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream. + +Lock f54->data_mutex when entering the function statement since jumping +to the 'error' label when checking report_size fails causes that mutex +to be unlocked. + +This bug has been detected by the Clang thread-safety checker. + +Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics") +Signed-off-by: Bart Van Assche +Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/rmi4/rmi_f54.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/input/rmi4/rmi_f54.c ++++ b/drivers/input/rmi4/rmi_f54.c +@@ -538,6 +538,8 @@ static void rmi_f54_work(struct work_str + int error; + int i; + ++ mutex_lock(&f54->data_mutex); ++ + report_size = rmi_f54_get_report_size(f54); + if (report_size == 0) { + dev_err(&fn->dev, "Bad report size, report type=%d\n", +@@ -546,8 +548,6 @@ static void rmi_f54_work(struct work_str + goto error; /* retry won't help */ + } + +- mutex_lock(&f54->data_mutex); +- + /* + * Need to check if command has completed. + * If not try again later. diff --git a/queue-6.18/input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch b/queue-6.18/input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch new file mode 100644 index 0000000000..e1e74813e9 --- /dev/null +++ b/queue-6.18/input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch @@ -0,0 +1,41 @@ +From 0d9363a764d9d601a05591f9695cea8b429e9be3 Mon Sep 17 00:00:00 2001 +From: Shengyu Qu +Date: Fri, 3 Apr 2026 22:07:28 -0700 +Subject: Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode + +From: Shengyu Qu + +commit 0d9363a764d9d601a05591f9695cea8b429e9be3 upstream. + +BETOP's BTP-KP50B and BTP-KP50C controller's wireless dongles are both +working as standard Xbox 360 controllers. Add USB device IDs for them to +xpad driver. + +Signed-off-by: Shengyu Qu +Link: https://patch.msgid.link/TY4PR01MB14432B4B298EA186E5F86C46B9855A@TY4PR01MB14432.jpnprd01.prod.outlook.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -360,6 +360,8 @@ static const struct xpad_device { + { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, + { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 }, ++ { 0x20bc, 0x5134, "BETOP BTP-KP50B Xinput Dongle", 0, XTYPE_XBOX360 }, ++ { 0x20bc, 0x514a, "BETOP BTP-KP50C Xinput Dongle", 0, XTYPE_XBOX360 }, + { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x2064, "PowerA Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, +@@ -562,6 +564,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ + XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */ ++ XPAD_XBOX360_VENDOR(0x20bc), /* BETOP wireless dongles */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOX360_VENDOR(0x2345), /* Machenike Controllers */ diff --git a/queue-6.18/input-xpad-add-support-for-razer-wolverine-v3-pro.patch b/queue-6.18/input-xpad-add-support-for-razer-wolverine-v3-pro.patch new file mode 100644 index 0000000000..26d8c8e93c --- /dev/null +++ b/queue-6.18/input-xpad-add-support-for-razer-wolverine-v3-pro.patch @@ -0,0 +1,36 @@ +From e2b0ae529db4766584e77647cefe3ec15c3d842e Mon Sep 17 00:00:00 2001 +From: Zoltan Illes +Date: Fri, 3 Apr 2026 22:03:42 -0700 +Subject: Input: xpad - add support for Razer Wolverine V3 Pro + +From: Zoltan Illes + +commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream. + +Add device IDs for the Razer Wolverine V3 Pro controller in both +wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes. + +The controller uses the Xbox 360 protocol (vendor-specific class, +subclass 93, protocol 1) on interface 0 with an identical 20-byte +input report layout, so no additional processing is needed. + +Signed-off-by: Zoltan Illes +Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -313,6 +313,8 @@ static const struct xpad_device { + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 }, ++ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, diff --git a/queue-6.18/mei-me-reduce-the-scope-on-unexpected-reset.patch b/queue-6.18/mei-me-reduce-the-scope-on-unexpected-reset.patch new file mode 100644 index 0000000000..064ba89c29 --- /dev/null +++ b/queue-6.18/mei-me-reduce-the-scope-on-unexpected-reset.patch @@ -0,0 +1,61 @@ +From 8c27b1bce059a11a8d3c8682984e13866f0714af Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Mon, 30 Mar 2026 11:38:30 +0300 +Subject: mei: me: reduce the scope on unexpected reset + +From: Alexander Usyskin + +commit 8c27b1bce059a11a8d3c8682984e13866f0714af upstream. + +After commit 2cedb296988c ("mei: me: trigger link reset if hw ready is unexpected") +some devices started to show long resume times (5-7 seconds). +This happens as mei falsely detects unready hardware, +starts parallel link reset flow and triggers link reset timeouts +in the resume callback. + +Address it by performing detection of unready hardware only +when driver is in the MEI_DEV_ENABLED state instead of blacklisting +states as done in the original patch. +This eliminates active waitqueue check as in MEI_DEV_ENABLED state +there will be no active waitqueue. + +Reviewed-by: Rafael J. Wysocki (Intel) +Reported-by: Todd Brandt +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221023 +Tested-by: Todd Brandt +Fixes: 2cedb296988c ("mei: me: trigger link reset if hw ready is unexpected") +Cc: stable +Signed-off-by: Alexander Usyskin +Link: https://patch.msgid.link/20260330083830.536056-1-alexander.usyskin@intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -1337,19 +1337,13 @@ irqreturn_t mei_me_irq_thread_handler(in + /* check if we need to start the dev */ + if (!mei_host_is_ready(dev)) { + if (mei_hw_is_ready(dev)) { +- /* synchronized by dev mutex */ +- if (waitqueue_active(&dev->wait_hw_ready)) { +- dev_dbg(&dev->dev, "we need to start the dev.\n"); +- dev->recvd_hw_ready = true; +- wake_up(&dev->wait_hw_ready); +- } else if (dev->dev_state != MEI_DEV_UNINITIALIZED && +- dev->dev_state != MEI_DEV_POWERING_DOWN && +- dev->dev_state != MEI_DEV_POWER_DOWN) { ++ if (dev->dev_state == MEI_DEV_ENABLED) { + dev_dbg(&dev->dev, "Force link reset.\n"); + schedule_work(&dev->reset_work); + } else { +- dev_dbg(&dev->dev, "Ignore this interrupt in state = %d\n", +- dev->dev_state); ++ dev_dbg(&dev->dev, "we need to start the dev.\n"); ++ dev->recvd_hw_ready = true; ++ wake_up(&dev->wait_hw_ready); + } + } else { + dev_dbg(&dev->dev, "Spurious Interrupt\n"); diff --git a/queue-6.18/series b/queue-6.18/series index f19f00e0e8..4a51c2ae87 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -170,3 +170,40 @@ drm-amdgpu-pm-drop-smu-driver-if-version-not-matched-messages.patch usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch usb-serial-option-add-support-for-rolling-wireless-rw135r-gl.patch usb-core-add-no_lpm-quirk-for-razer-kiyo-pro-webcam.patch +input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch +input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch +input-bcm5974-recover-from-failed-mode-switch.patch +input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch +input-xpad-add-support-for-razer-wolverine-v3-pro.patch +iio-adc-ti-ads7950-normalize-return-value-of-gpio_get.patch +iio-adc-ti-ads7950-do-not-clobber-gpio-state-in-ti_ads7950_get.patch +iio-adc-ade9000-fix-wrong-return-type-in-streaming-push.patch +iio-adc-ade9000-fix-wrong-register-in-calibbias-case-for-active-power.patch +iio-adc-ade9000-move-mutex-init-before-irq-registration.patch +iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch +iio-accel-fix-adxl355-temperature-signature-value.patch +iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch +iio-accel-adxl313-add-missing-error-check-in-predisable.patch +iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch +iio-imu-adis16550-fix-swapped-gyro-accel-filter-functions.patch +iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch +iio-light-veml6070-fix-veml6070_read-return-value.patch +iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch +iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch +iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch +iio-gyro-mpu3050-fix-irq-resource-leak.patch +iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch +iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch +mei-me-reduce-the-scope-on-unexpected-reset.patch +gpib-lpvo_usb-fix-memory-leak-on-disconnect.patch +usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch +usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch +usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch +usb-misc-usbio-fix-urb-memory-leak-on-submit-failure.patch +usb-host-xhci-sideband-delegate-offload_usage-tracking-to-class-drivers.patch +usb-ehci-brcm-fix-sleep-during-atomic.patch +usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch +usb-core-phy-avoid-double-use-of-usb3-phy.patch +usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch +usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch +usb-core-use-dedicated-spinlock-for-offload-state.patch diff --git a/queue-6.18/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch b/queue-6.18/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch new file mode 100644 index 0000000000..2e38a04156 --- /dev/null +++ b/queue-6.18/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch @@ -0,0 +1,41 @@ +From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Tue, 31 Mar 2026 08:04:07 +0800 +Subject: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue + +From: Yongchao Wu + +commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream. + +When the gadget endpoint is disabled or not yet configured, the ep->desc +pointer can be NULL. This leads to a NULL pointer dereference when +__cdns3_gadget_ep_queue() is called, causing a kernel crash. + +Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the +standard return code for unconfigured endpoints. + +This prevents potential crashes when ep_queue is called on endpoints +that are not ready. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struc + struct cdns3_request *priv_req; + int ret = 0; + ++ if (!ep->desc) ++ return -ESHUTDOWN; ++ + request->actual = 0; + request->status = -EINPROGRESS; + priv_req = to_cdns3_request(request); diff --git a/queue-6.18/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch b/queue-6.18/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch new file mode 100644 index 0000000000..134350c31f --- /dev/null +++ b/queue-6.18/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch @@ -0,0 +1,62 @@ +From c32f8748d70c8fc77676ad92ed76cede17bf2c48 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Wed, 1 Apr 2026 08:10:00 +0800 +Subject: usb: cdns3: gadget: fix state inconsistency on gadget init failure + +From: Yongchao Wu + +commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream. + +When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode +while software state remains INACTIVE, creating hardware/software state +inconsistency. + +When switching to host mode via sysfs: + echo host > /sys/class/usb_role/13180000.usb-role-switch/role + +The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, +so cdns_role_stop() skips cleanup because state is still INACTIVE. +This violates the DRD controller design specification (Figure22), +which requires returning to idle state before switching roles. + +This leads to a synchronous external abort in xhci_gen_setup() when +setting up the host controller: + +[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 +[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget +[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed +... +[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller +[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP +[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 +[ 1301.393391] backtrace: + ... + xhci_gen_setup+0xa4/0x408 <-- CRASH + xhci_plat_setup+0x44/0x58 + usb_add_hcd+0x284/0x678 + ... + cdns_role_set+0x9c/0xbc <-- Role switch + +Fix by calling cdns_drd_gadget_off() in the error path to properly +clean up the DRD gadget state. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -3432,6 +3432,7 @@ static int __cdns3_gadget_init(struct cd + ret = cdns3_gadget_start(cdns); + if (ret) { + pm_runtime_put_sync(cdns->dev); ++ cdns_drd_gadget_off(cdns); + return ret; + } + diff --git a/queue-6.18/usb-core-phy-avoid-double-use-of-usb3-phy.patch b/queue-6.18/usb-core-phy-avoid-double-use-of-usb3-phy.patch new file mode 100644 index 0000000000..b0522fbeeb --- /dev/null +++ b/queue-6.18/usb-core-phy-avoid-double-use-of-usb3-phy.patch @@ -0,0 +1,70 @@ +From 0179c6da0793ae03607002c284b53b6d584172d0 Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Mon, 30 Mar 2026 17:02:42 +0200 +Subject: usb: core: phy: avoid double use of 'usb3-phy' + +From: Gabor Juhos + +commit 0179c6da0793ae03607002c284b53b6d584172d0 upstream. + +Commit 53a2d95df836 ("usb: core: add phy notify connect and disconnect") +causes double use of the 'usb3-phy' in certain cases. + +Since that commit, if a generic PHY named 'usb3-phy' is specified in +the device tree, that is getting added to the 'phy_roothub' list of the +secondary HCD by the usb_phy_roothub_alloc_usb3_phy() function. However, +that PHY is getting added also to the primary HCD's 'phy_roothub' list +by usb_phy_roothub_alloc() if there is no generic PHY specified with +'usb2-phy' name. + +This causes that the usb_add_hcd() function executes each phy operations +twice on the 'usb3-phy'. Once when the primary HCD is added, then once +again when the secondary HCD is added. + +The issue affects the Marvell Armada 3700 platform at least, where a +custom name is used for the USB2 PHY: + + $ git grep 'phy-names.*usb3' arch/arm64/boot/dts/marvell/armada-37xx.dtsi | tr '\t' ' ' + arch/arm64/boot/dts/marvell/armada-37xx.dtsi: phy-names = "usb3-phy", "usb2-utmi-otg-phy"; + +Extend the usb_phy_roothub_alloc_usb3_phy() function to skip adding the +'usb3-phy' to the 'phy_roothub' list of the secondary HCD when 'usb2-phy' +is not specified in the device tree to avoid the double use. + +Fixes: 53a2d95df836 ("usb: core: add phy notify connect and disconnect") +Cc: stable +Signed-off-by: Gabor Juhos +Link: https://patch.msgid.link/20260330-usb-avoid-usb3-phy-double-use-v1-1-d2113aecb535@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/phy.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/phy.c ++++ b/drivers/usb/core/phy.c +@@ -114,7 +114,7 @@ EXPORT_SYMBOL_GPL(usb_phy_roothub_alloc) + struct usb_phy_roothub *usb_phy_roothub_alloc_usb3_phy(struct device *dev) + { + struct usb_phy_roothub *phy_roothub; +- int num_phys; ++ int num_phys, usb2_phy_index; + + if (!IS_ENABLED(CONFIG_GENERIC_PHY)) + return NULL; +@@ -124,6 +124,16 @@ struct usb_phy_roothub *usb_phy_roothub_ + if (num_phys <= 0) + return NULL; + ++ /* ++ * If 'usb2-phy' is not present, usb_phy_roothub_alloc() added ++ * all PHYs to the primary HCD's phy_roothub already, so skip ++ * adding 'usb3-phy' here to avoid double use of that. ++ */ ++ usb2_phy_index = of_property_match_string(dev->of_node, "phy-names", ++ "usb2-phy"); ++ if (usb2_phy_index < 0) ++ return NULL; ++ + phy_roothub = devm_kzalloc(dev, sizeof(*phy_roothub), GFP_KERNEL); + if (!phy_roothub) + return ERR_PTR(-ENOMEM); diff --git a/queue-6.18/usb-core-use-dedicated-spinlock-for-offload-state.patch b/queue-6.18/usb-core-use-dedicated-spinlock-for-offload-state.patch new file mode 100644 index 0000000000..67a36a2355 --- /dev/null +++ b/queue-6.18/usb-core-use-dedicated-spinlock-for-offload-state.patch @@ -0,0 +1,364 @@ +From bd3d245b0fef571f93504904df62b8865b1c0d34 Mon Sep 17 00:00:00 2001 +From: Guan-Yu Lin +Date: Wed, 1 Apr 2026 12:32:17 +0000 +Subject: usb: core: use dedicated spinlock for offload state + +From: Guan-Yu Lin + +commit bd3d245b0fef571f93504904df62b8865b1c0d34 upstream. + +Replace the coarse USB device lock with a dedicated offload_lock +spinlock to reduce contention during offload operations. Use +offload_pm_locked to synchronize with PM transitions and replace +the legacy offload_at_suspend flag. + +Optimize usb_offload_get/put by switching from auto-resume/suspend +to pm_runtime_get_if_active(). This ensures offload state is only +modified when the device is already active, avoiding unnecessary +power transitions. + +Cc: stable +Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage") +Signed-off-by: Guan-Yu Lin +Tested-by: Hailong Liu +Acked-by: Mathias Nyman +Link: https://patch.msgid.link/20260401123238.3790062-2-guanyulin@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/driver.c | 23 +++++--- + drivers/usb/core/offload.c | 102 ++++++++++++++++++++++----------------- + drivers/usb/core/usb.c | 1 + drivers/usb/host/xhci-sideband.c | 4 - + include/linux/usb.h | 10 +++ + 5 files changed, 84 insertions(+), 56 deletions(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1415,14 +1415,16 @@ static int usb_suspend_both(struct usb_d + int status = 0; + int i = 0, n = 0; + struct usb_interface *intf; ++ bool offload_active = false; + + if (udev->state == USB_STATE_NOTATTACHED || + udev->state == USB_STATE_SUSPENDED) + goto done; + ++ usb_offload_set_pm_locked(udev, true); + if (msg.event == PM_EVENT_SUSPEND && usb_offload_check(udev)) { + dev_dbg(&udev->dev, "device offloaded, skip suspend.\n"); +- udev->offload_at_suspend = 1; ++ offload_active = true; + } + + /* Suspend all the interfaces and then udev itself */ +@@ -1436,8 +1438,7 @@ static int usb_suspend_both(struct usb_d + * interrupt urbs, allowing interrupt events to be + * handled during system suspend. + */ +- if (udev->offload_at_suspend && +- intf->needs_remote_wakeup) { ++ if (offload_active && intf->needs_remote_wakeup) { + dev_dbg(&intf->dev, + "device offloaded, skip suspend.\n"); + continue; +@@ -1452,7 +1453,7 @@ static int usb_suspend_both(struct usb_d + } + } + if (status == 0) { +- if (!udev->offload_at_suspend) ++ if (!offload_active) + status = usb_suspend_device(udev, msg); + + /* +@@ -1498,7 +1499,7 @@ static int usb_suspend_both(struct usb_d + */ + } else { + udev->can_submit = 0; +- if (!udev->offload_at_suspend) { ++ if (!offload_active) { + for (i = 0; i < 16; ++i) { + usb_hcd_flush_endpoint(udev, udev->ep_out[i]); + usb_hcd_flush_endpoint(udev, udev->ep_in[i]); +@@ -1507,6 +1508,8 @@ static int usb_suspend_both(struct usb_d + } + + done: ++ if (status != 0) ++ usb_offload_set_pm_locked(udev, false); + dev_vdbg(&udev->dev, "%s: status %d\n", __func__, status); + return status; + } +@@ -1536,16 +1539,19 @@ static int usb_resume_both(struct usb_de + int status = 0; + int i; + struct usb_interface *intf; ++ bool offload_active = false; + + if (udev->state == USB_STATE_NOTATTACHED) { + status = -ENODEV; + goto done; + } + udev->can_submit = 1; ++ if (msg.event == PM_EVENT_RESUME) ++ offload_active = usb_offload_check(udev); + + /* Resume the device */ + if (udev->state == USB_STATE_SUSPENDED || udev->reset_resume) { +- if (!udev->offload_at_suspend) ++ if (!offload_active) + status = usb_resume_device(udev, msg); + else + dev_dbg(&udev->dev, +@@ -1562,8 +1568,7 @@ static int usb_resume_both(struct usb_de + * pending interrupt urbs, allowing interrupt events + * to be handled during system suspend. + */ +- if (udev->offload_at_suspend && +- intf->needs_remote_wakeup) { ++ if (offload_active && intf->needs_remote_wakeup) { + dev_dbg(&intf->dev, + "device offloaded, skip resume.\n"); + continue; +@@ -1572,11 +1577,11 @@ static int usb_resume_both(struct usb_de + udev->reset_resume); + } + } +- udev->offload_at_suspend = 0; + usb_mark_last_busy(udev); + + done: + dev_vdbg(&udev->dev, "%s: status %d\n", __func__, status); ++ usb_offload_set_pm_locked(udev, false); + if (!status) + udev->reset_resume = 0; + return status; +--- a/drivers/usb/core/offload.c ++++ b/drivers/usb/core/offload.c +@@ -25,33 +25,30 @@ + */ + int usb_offload_get(struct usb_device *udev) + { +- int ret; ++ int ret = 0; + +- usb_lock_device(udev); +- if (udev->state == USB_STATE_NOTATTACHED) { +- usb_unlock_device(udev); ++ if (!usb_get_dev(udev)) + return -ENODEV; +- } + +- if (udev->state == USB_STATE_SUSPENDED || +- udev->offload_at_suspend) { +- usb_unlock_device(udev); +- return -EBUSY; ++ if (pm_runtime_get_if_active(&udev->dev) != 1) { ++ ret = -EBUSY; ++ goto err_rpm; + } + +- /* +- * offload_usage could only be modified when the device is active, since +- * it will alter the suspend flow of the device. +- */ +- ret = usb_autoresume_device(udev); +- if (ret < 0) { +- usb_unlock_device(udev); +- return ret; ++ spin_lock(&udev->offload_lock); ++ ++ if (udev->offload_pm_locked) { ++ ret = -EAGAIN; ++ goto err; + } + + udev->offload_usage++; +- usb_autosuspend_device(udev); +- usb_unlock_device(udev); ++ ++err: ++ spin_unlock(&udev->offload_lock); ++ pm_runtime_put_autosuspend(&udev->dev); ++err_rpm: ++ usb_put_dev(udev); + + return ret; + } +@@ -69,35 +66,32 @@ EXPORT_SYMBOL_GPL(usb_offload_get); + */ + int usb_offload_put(struct usb_device *udev) + { +- int ret; ++ int ret = 0; + +- usb_lock_device(udev); +- if (udev->state == USB_STATE_NOTATTACHED) { +- usb_unlock_device(udev); ++ if (!usb_get_dev(udev)) + return -ENODEV; +- } + +- if (udev->state == USB_STATE_SUSPENDED || +- udev->offload_at_suspend) { +- usb_unlock_device(udev); +- return -EBUSY; ++ if (pm_runtime_get_if_active(&udev->dev) != 1) { ++ ret = -EBUSY; ++ goto err_rpm; + } + +- /* +- * offload_usage could only be modified when the device is active, since +- * it will alter the suspend flow of the device. +- */ +- ret = usb_autoresume_device(udev); +- if (ret < 0) { +- usb_unlock_device(udev); +- return ret; ++ spin_lock(&udev->offload_lock); ++ ++ if (udev->offload_pm_locked) { ++ ret = -EAGAIN; ++ goto err; + } + + /* Drop the count when it wasn't 0, ignore the operation otherwise. */ + if (udev->offload_usage) + udev->offload_usage--; +- usb_autosuspend_device(udev); +- usb_unlock_device(udev); ++ ++err: ++ spin_unlock(&udev->offload_lock); ++ pm_runtime_put_autosuspend(&udev->dev); ++err_rpm: ++ usb_put_dev(udev); + + return ret; + } +@@ -112,25 +106,47 @@ EXPORT_SYMBOL_GPL(usb_offload_put); + * management. + * + * The caller must hold @udev's device lock. In addition, the caller should +- * ensure downstream usb devices are all either suspended or marked as +- * "offload_at_suspend" to ensure the correctness of the return value. ++ * ensure the device itself and the downstream usb devices are all marked as ++ * "offload_pm_locked" to ensure the correctness of the return value. + * + * Returns true on any offload activity, false otherwise. + */ + bool usb_offload_check(struct usb_device *udev) __must_hold(&udev->dev->mutex) + { + struct usb_device *child; +- bool active; ++ bool active = false; + int port1; + ++ if (udev->offload_usage) ++ return true; ++ + usb_hub_for_each_child(udev, port1, child) { + usb_lock_device(child); + active = usb_offload_check(child); + usb_unlock_device(child); ++ + if (active) +- return true; ++ break; + } + +- return !!udev->offload_usage; ++ return active; + } + EXPORT_SYMBOL_GPL(usb_offload_check); ++ ++/** ++ * usb_offload_set_pm_locked - set the PM lock state of a USB device ++ * @udev: the USB device to modify ++ * @locked: the new lock state ++ * ++ * Setting @locked to true prevents offload_usage from being modified. This ++ * ensures that offload activities cannot be started or stopped during critical ++ * power management transitions, maintaining a stable state for the duration ++ * of the transition. ++ */ ++void usb_offload_set_pm_locked(struct usb_device *udev, bool locked) ++{ ++ spin_lock(&udev->offload_lock); ++ udev->offload_pm_locked = locked; ++ spin_unlock(&udev->offload_lock); ++} ++EXPORT_SYMBOL_GPL(usb_offload_set_pm_locked); +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -670,6 +670,7 @@ struct usb_device *usb_alloc_dev(struct + set_dev_node(&dev->dev, dev_to_node(bus->sysdev)); + dev->state = USB_STATE_ATTACHED; + dev->lpm_disable_count = 1; ++ spin_lock_init(&dev->offload_lock); + dev->offload_usage = 0; + atomic_set(&dev->urbnum, 0); + +--- a/drivers/usb/host/xhci-sideband.c ++++ b/drivers/usb/host/xhci-sideband.c +@@ -285,8 +285,8 @@ EXPORT_SYMBOL_GPL(xhci_sideband_get_even + * Allow other drivers, such as usb controller driver, to check if there are + * any sideband activity on the host controller. This information could be used + * for power management or other forms of resource management. The caller should +- * ensure downstream usb devices are all either suspended or marked as +- * "offload_at_suspend" to ensure the correctness of the return value. ++ * ensure downstream usb devices are all marked as "offload_pm_locked" to ensure ++ * the correctness of the return value. + * + * Returns true on any active sideband existence, false otherwise. + */ +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -21,6 +21,7 @@ + #include /* for struct completion */ + #include /* for current && schedule_timeout */ + #include /* for struct mutex */ ++#include /* for spinlock_t */ + #include /* for runtime PM */ + + struct usb_device; +@@ -636,8 +637,9 @@ struct usb3_lpm_parameters { + * @do_remote_wakeup: remote wakeup should be enabled + * @reset_resume: needs reset instead of resume + * @port_is_suspended: the upstream port is suspended (L2 or U3) +- * @offload_at_suspend: offload activities during suspend is enabled. ++ * @offload_pm_locked: prevents offload_usage changes during PM transitions. + * @offload_usage: number of offload activities happening on this usb device. ++ * @offload_lock: protects offload_usage and offload_pm_locked + * @slot_id: Slot ID assigned by xHCI + * @l1_params: best effor service latency for USB2 L1 LPM state, and L1 timeout. + * @u1_params: exit latencies for USB3 U1 LPM state, and hub-initiated timeout. +@@ -726,8 +728,9 @@ struct usb_device { + unsigned do_remote_wakeup:1; + unsigned reset_resume:1; + unsigned port_is_suspended:1; +- unsigned offload_at_suspend:1; ++ unsigned offload_pm_locked:1; + int offload_usage; ++ spinlock_t offload_lock; + enum usb_link_tunnel_mode tunnel_mode; + struct device_link *usb4_link; + +@@ -849,6 +852,7 @@ static inline void usb_mark_last_busy(st + int usb_offload_get(struct usb_device *udev); + int usb_offload_put(struct usb_device *udev); + bool usb_offload_check(struct usb_device *udev); ++void usb_offload_set_pm_locked(struct usb_device *udev, bool locked); + #else + + static inline int usb_offload_get(struct usb_device *udev) +@@ -857,6 +861,8 @@ static inline int usb_offload_put(struct + { return 0; } + static inline bool usb_offload_check(struct usb_device *udev) + { return false; } ++static inline void usb_offload_set_pm_locked(struct usb_device *udev, bool locked) ++{ } + #endif + + extern int usb_disable_lpm(struct usb_device *udev); diff --git a/queue-6.18/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch b/queue-6.18/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch new file mode 100644 index 0000000000..2c07c1f64b --- /dev/null +++ b/queue-6.18/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch @@ -0,0 +1,45 @@ +From 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a Mon Sep 17 00:00:00 2001 +From: Juno Choi +Date: Tue, 24 Mar 2026 10:49:10 +0900 +Subject: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() + +From: Juno Choi + +commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream. + +dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, +which expects hsotg->lock to be held since it does spin_unlock/spin_lock +around the gadget driver callback invocation. + +However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() +without holding the lock. This leads to: + - spin_unlock on a lock that is not held (undefined behavior) + - The lock remaining held after dwc2_gadget_exit_clock_gating() returns, + causing a deadlock when spin_lock_irqsave() is called later in the + same function. + +Fix this by acquiring hsotg->lock before calling +dwc2_gadget_exit_clock_gating() and releasing it afterwards, which +satisfies the locking requirement of the call_gadget() macro. + +Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended") +Cc: stable +Signed-off-by: Juno Choi +Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4607,7 +4607,9 @@ static int dwc2_hsotg_udc_stop(struct us + /* Exit clock gating when driver is stopped. */ + if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE && + hsotg->bus_suspended && !hsotg->params.no_clock_gating) { ++ spin_lock_irqsave(&hsotg->lock, flags); + dwc2_gadget_exit_clock_gating(hsotg, 0); ++ spin_unlock_irqrestore(&hsotg->lock, flags); + } + + /* all endpoints should be shutdown */ diff --git a/queue-6.18/usb-ehci-brcm-fix-sleep-during-atomic.patch b/queue-6.18/usb-ehci-brcm-fix-sleep-during-atomic.patch new file mode 100644 index 0000000000..4fc670db96 --- /dev/null +++ b/queue-6.18/usb-ehci-brcm-fix-sleep-during-atomic.patch @@ -0,0 +1,37 @@ +From 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 18 Mar 2026 11:57:07 -0700 +Subject: usb: ehci-brcm: fix sleep during atomic + +From: Justin Chen + +commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream. + +echi_brcm_wait_for_sof() gets called after disabling interrupts +in ehci_brcm_hub_control(). Use the atomic version of poll_timeout +to fix the warning. + +Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's") +Cc: stable +Signed-off-by: Justin Chen +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ehci-brcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-brcm.c ++++ b/drivers/usb/host/ehci-brcm.c +@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so + int res; + + /* Wait for next microframe (every 125 usecs) */ +- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val, +- val != frame_idx, 1, 130); ++ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index, ++ val, val != frame_idx, 1, 130); + if (res) + ehci_err(ehci, "Error waiting for SOF\n"); + udelay(delay); diff --git a/queue-6.18/usb-host-xhci-sideband-delegate-offload_usage-tracking-to-class-drivers.patch b/queue-6.18/usb-host-xhci-sideband-delegate-offload_usage-tracking-to-class-drivers.patch new file mode 100644 index 0000000000..bb390404de --- /dev/null +++ b/queue-6.18/usb-host-xhci-sideband-delegate-offload_usage-tracking-to-class-drivers.patch @@ -0,0 +1,122 @@ +From 5abbe6ecc6203355c770bf232ade88e29c960049 Mon Sep 17 00:00:00 2001 +From: Guan-Yu Lin +Date: Wed, 1 Apr 2026 12:32:18 +0000 +Subject: usb: host: xhci-sideband: delegate offload_usage tracking to class drivers + +From: Guan-Yu Lin + +commit 5abbe6ecc6203355c770bf232ade88e29c960049 upstream. + +Remove usb_offload_get() and usb_offload_put() from the xHCI sideband +interrupter creation and removal paths. + +The responsibility of manipulating offload_usage now lies entirely with +the USB class drivers. They have the precise context of when an offload +data stream actually starts and stops, ensuring a much more accurate +representation of offload activity for power management. + +Cc: stable +Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage") +Signed-off-by: Guan-Yu Lin +Tested-by: Hailong Liu +Tested-by: hailong.liu@oppo.com +Acked-by: Mathias Nyman +Link: https://patch.msgid.link/20260401123238.3790062-3-guanyulin@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-sideband.c | 14 +------------- + sound/usb/qcom/qc_audio_offload.c | 10 +++++++++- + 2 files changed, 10 insertions(+), 14 deletions(-) + +--- a/drivers/usb/host/xhci-sideband.c ++++ b/drivers/usb/host/xhci-sideband.c +@@ -93,8 +93,6 @@ __xhci_sideband_remove_endpoint(struct x + static void + __xhci_sideband_remove_interrupter(struct xhci_sideband *sb) + { +- struct usb_device *udev; +- + lockdep_assert_held(&sb->mutex); + + if (!sb->ir) +@@ -102,10 +100,6 @@ __xhci_sideband_remove_interrupter(struc + + xhci_remove_secondary_interrupter(xhci_to_hcd(sb->xhci), sb->ir); + sb->ir = NULL; +- udev = sb->vdev->udev; +- +- if (udev->state != USB_STATE_NOTATTACHED) +- usb_offload_put(udev); + } + + /* sideband api functions */ +@@ -328,9 +322,6 @@ int + xhci_sideband_create_interrupter(struct xhci_sideband *sb, int num_seg, + bool ip_autoclear, u32 imod_interval, int intr_num) + { +- int ret = 0; +- struct usb_device *udev; +- + if (!sb || !sb->xhci) + return -ENODEV; + +@@ -348,12 +339,9 @@ xhci_sideband_create_interrupter(struct + if (!sb->ir) + return -ENOMEM; + +- udev = sb->vdev->udev; +- ret = usb_offload_get(udev); +- + sb->ir->ip_autoclear = ip_autoclear; + +- return ret; ++ return 0; + } + EXPORT_SYMBOL_GPL(xhci_sideband_create_interrupter); + +--- a/sound/usb/qcom/qc_audio_offload.c ++++ b/sound/usb/qcom/qc_audio_offload.c +@@ -699,6 +699,7 @@ static void uaudio_event_ring_cleanup_fr + uaudio_iommu_unmap(MEM_EVENT_RING, IOVA_BASE, PAGE_SIZE, + PAGE_SIZE); + xhci_sideband_remove_interrupter(uadev[dev->chip->card->number].sb); ++ usb_offload_put(dev->udev); + } + } + +@@ -1182,12 +1183,16 @@ static int uaudio_event_ring_setup(struc + dma_coherent = dev_is_dma_coherent(subs->dev->bus->sysdev); + er_pa = 0; + ++ ret = usb_offload_get(subs->dev); ++ if (ret < 0) ++ goto exit; ++ + /* event ring */ + ret = xhci_sideband_create_interrupter(uadev[card_num].sb, 1, false, + 0, uaudio_qdev->data->intr_num); + if (ret < 0) { + dev_err(&subs->dev->dev, "failed to fetch interrupter\n"); +- goto exit; ++ goto put_offload; + } + + sgt = xhci_sideband_get_event_buffer(uadev[card_num].sb); +@@ -1219,6 +1224,8 @@ clear_pa: + mem_info->dma = 0; + remove_interrupter: + xhci_sideband_remove_interrupter(uadev[card_num].sb); ++put_offload: ++ usb_offload_put(subs->dev); + exit: + return ret; + } +@@ -1483,6 +1490,7 @@ unmap_er: + uaudio_iommu_unmap(MEM_EVENT_RING, IOVA_BASE, PAGE_SIZE, PAGE_SIZE); + free_sec_ring: + xhci_sideband_remove_interrupter(uadev[card_num].sb); ++ usb_offload_put(subs->dev); + drop_sync_ep: + if (subs->sync_endpoint) { + uaudio_iommu_unmap(MEM_XFER_RING, diff --git a/queue-6.18/usb-misc-usbio-fix-urb-memory-leak-on-submit-failure.patch b/queue-6.18/usb-misc-usbio-fix-urb-memory-leak-on-submit-failure.patch new file mode 100644 index 0000000000..e8ba25cdcc --- /dev/null +++ b/queue-6.18/usb-misc-usbio-fix-urb-memory-leak-on-submit-failure.patch @@ -0,0 +1,50 @@ +From 33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21 Mon Sep 17 00:00:00 2001 +From: Felix Gu +Date: Tue, 31 Mar 2026 20:05:08 +0800 +Subject: usb: misc: usbio: Fix URB memory leak on submit failure + +From: Felix Gu + +commit 33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21 upstream. + +When usb_submit_urb() fails in usbio_probe(), the previously allocated +URB is never freed, causing a memory leak. + +Fix this by jumping to err_free_urb label to properly release the URB +on the error path. + +Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver") +Cc: stable +Signed-off-by: Felix Gu +Reviewed-by: Oliver Neukum +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/usbio.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/usbio.c ++++ b/drivers/usb/misc/usbio.c +@@ -614,8 +614,10 @@ static int usbio_probe(struct usb_interf + usb_fill_bulk_urb(usbio->urb, udev, usbio->rx_pipe, usbio->rxbuf, + usbio->rxbuf_len, usbio_bulk_recv, usbio); + ret = usb_submit_urb(usbio->urb, GFP_KERNEL); +- if (ret) +- return dev_err_probe(dev, ret, "Submitting usb urb\n"); ++ if (ret) { ++ dev_err_probe(dev, ret, "Submitting usb urb\n"); ++ goto err_free_urb; ++ } + + mutex_lock(&usbio->ctrl_mutex); + +@@ -663,6 +665,7 @@ static int usbio_probe(struct usb_interf + err_unlock: + mutex_unlock(&usbio->ctrl_mutex); + usb_kill_urb(usbio->urb); ++err_free_urb: + usb_free_urb(usbio->urb); + + return ret; diff --git a/queue-6.18/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch b/queue-6.18/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch new file mode 100644 index 0000000000..3616bfecd1 --- /dev/null +++ b/queue-6.18/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch @@ -0,0 +1,31 @@ +From dd36014ec6042f424ef51b923e607772f7502ee7 Mon Sep 17 00:00:00 2001 +From: Miao Li +Date: Thu, 19 Mar 2026 13:39:27 +0800 +Subject: usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive + +From: Miao Li + +commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream. + +Another Silicon Motion flash drive also randomly work incorrectly +(lsusb does not list the device) on Huawei hisi platforms during +500 reboot cycles, and the DELAY_INIT quirk fixes this issue. + +Signed-off-by: Miao Li +Cc: stable +Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -402,6 +402,7 @@ static const struct usb_device_id usb_qu + + /* Silicon Motion Flash Drive */ + { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Sound Devices USBPre2 */ + { USB_DEVICE(0x0926, 0x0202), .driver_info = diff --git a/queue-6.18/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch b/queue-6.18/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch new file mode 100644 index 0000000000..ff0d3e8dc7 --- /dev/null +++ b/queue-6.18/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch @@ -0,0 +1,46 @@ +From 01af542392b5d41fd659d487015a71f627accce3 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Wed, 1 Apr 2026 10:51:42 +0800 +Subject: usb: ulpi: fix double free in ulpi_register_interface() error path + +From: Guangshuo Li + +commit 01af542392b5d41fd659d487015a71f627accce3 upstream. + +When device_register() fails, ulpi_register() calls put_device() on +ulpi->dev. + +The device release callback ulpi_dev_release() drops the OF node +reference and frees ulpi, but the current error path in +ulpi_register_interface() then calls kfree(ulpi) again, causing a +double free. + +Let put_device() handle the cleanup through ulpi_dev_release() and +avoid freeing ulpi again in ulpi_register_interface(). + +Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") +Cc: stable +Signed-off-by: Guangshuo Li +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/ulpi.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(str + ulpi->ops = ops; + + ret = ulpi_register(dev, ulpi); +- if (ret) { +- kfree(ulpi); ++ if (ret) + return ERR_PTR(ret); +- } ++ + + return ulpi; + } diff --git a/queue-6.18/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch b/queue-6.18/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch new file mode 100644 index 0000000000..681c842a95 --- /dev/null +++ b/queue-6.18/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch @@ -0,0 +1,37 @@ +From 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Mon Sep 17 00:00:00 2001 +From: Heitor Alves de Siqueira +Date: Thu, 12 Mar 2026 09:27:28 -0300 +Subject: usb: usbtmc: Flush anchored URBs in usbtmc_release + +From: Heitor Alves de Siqueira + +commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream. + +When calling usbtmc_release, pending anchored URBs must be flushed or +killed to prevent use-after-free errors (e.g. in the HCD giveback +path). Call usbtmc_draw_down() to allow anchored URBs to be completed. + +Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file") +Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f +Cc: stable +Signed-off-by: Heitor Alves de Siqueira +Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode * + list_del(&file_data->file_elem); + + spin_unlock_irq(&file_data->data->dev_lock); ++ ++ /* flush anchored URBs */ ++ usbtmc_draw_down(file_data); + mutex_unlock(&file_data->data->io_mutex); + + kref_put(&file_data->data->kref, usbtmc_delete);