From: Greg Kroah-Hartman Date: Tue, 7 Apr 2026 15:37:43 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d392493e6db433d8cd392560cd07a103f0914295;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch iio-gyro-mpu3050-fix-irq-resource-leak.patch iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch input-xpad-add-support-for-razer-wolverine-v3-pro.patch usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch usb-ehci-brcm-fix-sleep-during-atomic.patch usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch --- diff --git a/queue-5.15/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch b/queue-5.15/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch new file mode 100644 index 0000000000..08bff67cc3 --- /dev/null +++ b/queue-5.15/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch @@ -0,0 +1,32 @@ +From c354521708175d776d896f8bdae44b18711eccb6 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Thu, 12 Mar 2026 13:20:24 +0200 +Subject: iio: dac: ad5770r: fix error return in ad5770r_read_raw() + +From: Antoniu Miclaus + +commit c354521708175d776d896f8bdae44b18711eccb6 upstream. + +Return the error code from regmap_bulk_read() instead of 0 so +that I/O failures are properly propagated. + +Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support") +Signed-off-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5770r.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5770r.c ++++ b/drivers/iio/dac/ad5770r.c +@@ -323,7 +323,7 @@ static int ad5770r_read_raw(struct iio_d + chan->address, + st->transf_buf, 2); + if (ret) +- return 0; ++ return ret; + + buf16 = st->transf_buf[0] + (st->transf_buf[1] << 8); + *val = buf16 >> 2; diff --git a/queue-5.15/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch b/queue-5.15/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch new file mode 100644 index 0000000000..60caedd1b8 --- /dev/null +++ b/queue-5.15/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch @@ -0,0 +1,36 @@ +From edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:15 -0600 +Subject: iio: gyro: mpu3050: Fix incorrect free_irq() variable + +From: Ethan Tidmore + +commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream. + +The handler for the IRQ part of this driver is mpu3050->trig but, +in the teardown free_irq() is called with handler mpu3050. + +Use correct IRQ handler when calling free_irq(). + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1282,7 +1282,7 @@ int mpu3050_common_remove(struct device + pm_runtime_disable(dev); + iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) +- free_irq(mpu3050->irq, mpu3050); ++ free_irq(mpu3050->irq, mpu3050->trig); + iio_device_unregister(indio_dev); + mpu3050_power_down(mpu3050); + diff --git a/queue-5.15/iio-gyro-mpu3050-fix-irq-resource-leak.patch b/queue-5.15/iio-gyro-mpu3050-fix-irq-resource-leak.patch new file mode 100644 index 0000000000..836fbf38fc --- /dev/null +++ b/queue-5.15/iio-gyro-mpu3050-fix-irq-resource-leak.patch @@ -0,0 +1,50 @@ +From 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:16 -0600 +Subject: iio: gyro: mpu3050: Fix irq resource leak + +From: Ethan Tidmore + +commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream. + +The interrupt handler is setup but only a few lines down if +iio_trigger_register() fails the function returns without properly +releasing the handler. + +Add cleanup goto to resolve resource leak. + +Detected by Smatch: +drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn: +'irq' from request_threaded_irq() not released on lines: 1124. + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1141,11 +1141,16 @@ static int mpu3050_trigger_probe(struct + + ret = iio_trigger_register(mpu3050->trig); + if (ret) +- return ret; ++ goto err_iio_trigger; + + indio_dev->trig = iio_trigger_get(mpu3050->trig); + + return 0; ++ ++err_iio_trigger: ++ free_irq(mpu3050->irq, mpu3050->trig); ++ ++ return ret; + } + + int mpu3050_common_probe(struct device *dev, diff --git a/queue-5.15/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch b/queue-5.15/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch new file mode 100644 index 0000000000..b31054d74f --- /dev/null +++ b/queue-5.15/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch @@ -0,0 +1,41 @@ +From d14116f6529fa085b1a1b1f224dc9604e4d2a29c Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:18 -0600 +Subject: iio: gyro: mpu3050: Fix out-of-sequence free_irq() + +From: Ethan Tidmore + +commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream. + +The triggered buffer is initialized before the IRQ is requested. The +removal path currently calls iio_triggered_buffer_cleanup() before +free_irq(). This violates the expected LIFO. + +Place free_irq() in the correct location relative to +iio_triggered_buffer_cleanup(). + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Suggested-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1291,9 +1291,9 @@ int mpu3050_common_remove(struct device + pm_runtime_get_sync(dev); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); +- iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) + free_irq(mpu3050->irq, mpu3050->trig); ++ iio_triggered_buffer_cleanup(indio_dev); + mpu3050_power_down(mpu3050); + + return 0; diff --git a/queue-5.15/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch b/queue-5.15/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch new file mode 100644 index 0000000000..3a2a2404bd --- /dev/null +++ b/queue-5.15/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch @@ -0,0 +1,79 @@ +From 4c05799449108fb0e0a6bd30e65fffc71e60db4d Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:17 -0600 +Subject: iio: gyro: mpu3050: Move iio_device_register() to correct location + +From: Ethan Tidmore + +commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream. + +iio_device_register() should be at the end of the probe function to +prevent race conditions. + +Place iio_device_register() at the end of the probe function and place +iio_device_unregister() accordingly. + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Suggested-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1238,12 +1238,6 @@ int mpu3050_common_probe(struct device * + goto err_power_down; + } + +- ret = iio_device_register(indio_dev); +- if (ret) { +- dev_err(dev, "device register failed\n"); +- goto err_cleanup_buffer; +- } +- + dev_set_drvdata(dev, indio_dev); + + /* Check if we have an assigned IRQ to use as trigger */ +@@ -1266,9 +1260,20 @@ int mpu3050_common_probe(struct device * + pm_runtime_use_autosuspend(dev); + pm_runtime_put(dev); + ++ ret = iio_device_register(indio_dev); ++ if (ret) { ++ dev_err(dev, "device register failed\n"); ++ goto err_iio_device_register; ++ } ++ + return 0; + +-err_cleanup_buffer: ++err_iio_device_register: ++ pm_runtime_get_sync(dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_disable(dev); ++ if (irq) ++ free_irq(mpu3050->irq, mpu3050->trig); + iio_triggered_buffer_cleanup(indio_dev); + err_power_down: + mpu3050_power_down(mpu3050); +@@ -1282,13 +1287,13 @@ int mpu3050_common_remove(struct device + struct iio_dev *indio_dev = dev_get_drvdata(dev); + struct mpu3050 *mpu3050 = iio_priv(indio_dev); + ++ iio_device_unregister(indio_dev); + pm_runtime_get_sync(dev); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); + iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) + free_irq(mpu3050->irq, mpu3050->trig); +- iio_device_unregister(indio_dev); + mpu3050_power_down(mpu3050); + + return 0; diff --git a/queue-5.15/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch b/queue-5.15/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch new file mode 100644 index 0000000000..d1f1fdbe82 --- /dev/null +++ b/queue-5.15/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch @@ -0,0 +1,45 @@ +From 630748afa7030b272b7bee5df857e7bcf132ed51 Mon Sep 17 00:00:00 2001 +From: Francesco Lavra +Date: Wed, 25 Feb 2026 11:06:00 +0100 +Subject: iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only + +From: Francesco Lavra + +commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream. + +The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and +disabling the hardware FIFO, checks the contents of the hw->settings->batch +array at index sensor->id, and then sets the current ODR value in sensor +registers that depend on whether the register address is set in the above +array element. This logic is valid for internal sensors only, i.e. the +accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu: +st_lsm6dsx: add i2c embedded controller support"), this function is called +also when configuring the hardware FIFO for external sensors (i.e. sensors +accessed through the sensor hub functionality), which can result in +unrelated device registers being written. + +Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does +not touch any registers unless it is called for internal sensors. + +Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") +Signed-off-by: Francesco Lavra +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +@@ -201,6 +201,10 @@ static int st_lsm6dsx_set_fifo_odr(struc + const struct st_lsm6dsx_reg *batch_reg; + u8 data; + ++ /* Only internal sensors have a FIFO ODR configuration register. */ ++ if (sensor->id >= ARRAY_SIZE(hw->settings->batch)) ++ return 0; ++ + batch_reg = &hw->settings->batch[sensor->id]; + if (batch_reg->addr) { + int val; diff --git a/queue-5.15/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch b/queue-5.15/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch new file mode 100644 index 0000000000..3bc0183814 --- /dev/null +++ b/queue-5.15/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch @@ -0,0 +1,81 @@ +From fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Sat, 14 Mar 2026 17:18:10 -0500 +Subject: iio: light: vcnl4035: fix scan buffer on big-endian + +From: David Lechner + +commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream. + +Rework vcnl4035_trigger_consumer_handler() so that we are not passing +what should be a u16 value as an int * to regmap_read(). This won't +work on bit endian systems. + +Instead, add a new unsigned int variable to pass to regmap_read(). Then +copy that value into the buffer struct. + +The buffer array is replaced with a struct since there is only one value +being read. This allows us to use the correct u16 data type and has a +side-effect of simplifying the alignment specification. + +Also fix the endianness of the scan format from little-endian to CPU +endianness. Since we are using regmap to read the value, it will be +CPU-endian. + +Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") +Signed-off-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/vcnl4035.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -105,17 +105,23 @@ static irqreturn_t vcnl4035_trigger_cons + struct iio_dev *indio_dev = pf->indio_dev; + struct vcnl4035_data *data = iio_priv(indio_dev); + /* Ensure naturally aligned timestamp */ +- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; ++ struct { ++ u16 als_data; ++ aligned_s64 timestamp; ++ } buffer = { }; ++ unsigned int val; + int ret; + +- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); ++ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val); + if (ret < 0) { + dev_err(&data->client->dev, + "Trigger consumer can't read from sensor.\n"); + goto fail_read; + } +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, +- iio_get_time_ns(indio_dev)); ++ ++ buffer.als_data = val; ++ iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ++ iio_get_time_ns(indio_dev)); + + fail_read: + iio_trigger_notify_done(indio_dev->trig); +@@ -378,7 +384,7 @@ static const struct iio_chan_spec vcnl40 + .sign = 'u', + .realbits = 16, + .storagebits = 16, +- .endianness = IIO_LE, ++ .endianness = IIO_CPU, + }, + }, + { +@@ -392,7 +398,7 @@ static const struct iio_chan_spec vcnl40 + .sign = 'u', + .realbits = 16, + .storagebits = 16, +- .endianness = IIO_LE, ++ .endianness = IIO_CPU, + }, + }, + }; diff --git a/queue-5.15/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch b/queue-5.15/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch new file mode 100644 index 0000000000..59ea04d60a --- /dev/null +++ b/queue-5.15/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch @@ -0,0 +1,39 @@ +From 5839419cffc7788a356428d321e3ec18055c0286 Mon Sep 17 00:00:00 2001 +From: Christoffer Sandberg +Date: Mon, 23 Feb 2026 15:20:45 +0100 +Subject: Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table + +From: Christoffer Sandberg + +commit 5839419cffc7788a356428d321e3ec18055c0286 upstream. + +The device occasionally wakes up from suspend with missing input on the +internal keyboard and the following suspend attempt results in an instant +wake-up. The quirks fix both issues for this device. + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1181,6 +1181,13 @@ static const struct dmi_system_id i8042_ + }, + { + .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | diff --git a/queue-5.15/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch b/queue-5.15/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch new file mode 100644 index 0000000000..4c4a7f4213 --- /dev/null +++ b/queue-5.15/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch @@ -0,0 +1,45 @@ +From 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 23 Feb 2026 15:05:15 -0800 +Subject: Input: synaptics-rmi4 - fix a locking bug in an error path + +From: Bart Van Assche + +commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream. + +Lock f54->data_mutex when entering the function statement since jumping +to the 'error' label when checking report_size fails causes that mutex +to be unlocked. + +This bug has been detected by the Clang thread-safety checker. + +Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics") +Signed-off-by: Bart Van Assche +Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/rmi4/rmi_f54.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/input/rmi4/rmi_f54.c ++++ b/drivers/input/rmi4/rmi_f54.c +@@ -540,6 +540,8 @@ static void rmi_f54_work(struct work_str + int error; + int i; + ++ mutex_lock(&f54->data_mutex); ++ + report_size = rmi_f54_get_report_size(f54); + if (report_size == 0) { + dev_err(&fn->dev, "Bad report size, report type=%d\n", +@@ -548,8 +550,6 @@ static void rmi_f54_work(struct work_str + goto error; /* retry won't help */ + } + +- mutex_lock(&f54->data_mutex); +- + /* + * Need to check if command has completed. + * If not try again later. diff --git a/queue-5.15/input-xpad-add-support-for-razer-wolverine-v3-pro.patch b/queue-5.15/input-xpad-add-support-for-razer-wolverine-v3-pro.patch new file mode 100644 index 0000000000..de01a76c4c --- /dev/null +++ b/queue-5.15/input-xpad-add-support-for-razer-wolverine-v3-pro.patch @@ -0,0 +1,36 @@ +From e2b0ae529db4766584e77647cefe3ec15c3d842e Mon Sep 17 00:00:00 2001 +From: Zoltan Illes +Date: Fri, 3 Apr 2026 22:03:42 -0700 +Subject: Input: xpad - add support for Razer Wolverine V3 Pro + +From: Zoltan Illes + +commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream. + +Add device IDs for the Razer Wolverine V3 Pro controller in both +wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes. + +The controller uses the Xbox 360 protocol (vendor-specific class, +subclass 93, protocol 1) on interface 0 with an identical 20-byte +input report layout, so no additional processing is needed. + +Signed-off-by: Zoltan Illes +Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -271,6 +271,8 @@ static const struct xpad_device { + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 }, ++ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, diff --git a/queue-5.15/series b/queue-5.15/series index cce65d09d1..d4c7692e09 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -454,3 +454,20 @@ drm-ast-dp501-fix-initialization-of-scu2c.patch usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch usb-serial-option-add-support-for-rolling-wireless-rw135r-gl.patch usb-core-add-no_lpm-quirk-for-razer-kiyo-pro-webcam.patch +input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch +input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch +input-xpad-add-support-for-razer-wolverine-v3-pro.patch +iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch +iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch +iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch +iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch +iio-gyro-mpu3050-fix-irq-resource-leak.patch +iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch +iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch +usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch +usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch +usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch +usb-ehci-brcm-fix-sleep-during-atomic.patch +usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch +usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch +usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch diff --git a/queue-5.15/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch b/queue-5.15/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch new file mode 100644 index 0000000000..83fa6ecb49 --- /dev/null +++ b/queue-5.15/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch @@ -0,0 +1,41 @@ +From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Tue, 31 Mar 2026 08:04:07 +0800 +Subject: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue + +From: Yongchao Wu + +commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream. + +When the gadget endpoint is disabled or not yet configured, the ep->desc +pointer can be NULL. This leads to a NULL pointer dereference when +__cdns3_gadget_ep_queue() is called, causing a kernel crash. + +Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the +standard return code for unconfigured endpoints. + +This prevents potential crashes when ep_queue is called on endpoints +that are not ready. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -2586,6 +2586,9 @@ static int __cdns3_gadget_ep_queue(struc + struct cdns3_request *priv_req; + int ret = 0; + ++ if (!ep->desc) ++ return -ESHUTDOWN; ++ + request->actual = 0; + request->status = -EINPROGRESS; + priv_req = to_cdns3_request(request); diff --git a/queue-5.15/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch b/queue-5.15/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch new file mode 100644 index 0000000000..816b9bdfd5 --- /dev/null +++ b/queue-5.15/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch @@ -0,0 +1,62 @@ +From c32f8748d70c8fc77676ad92ed76cede17bf2c48 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Wed, 1 Apr 2026 08:10:00 +0800 +Subject: usb: cdns3: gadget: fix state inconsistency on gadget init failure + +From: Yongchao Wu + +commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream. + +When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode +while software state remains INACTIVE, creating hardware/software state +inconsistency. + +When switching to host mode via sysfs: + echo host > /sys/class/usb_role/13180000.usb-role-switch/role + +The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, +so cdns_role_stop() skips cleanup because state is still INACTIVE. +This violates the DRD controller design specification (Figure22), +which requires returning to idle state before switching roles. + +This leads to a synchronous external abort in xhci_gen_setup() when +setting up the host controller: + +[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 +[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget +[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed +... +[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller +[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP +[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 +[ 1301.393391] backtrace: + ... + xhci_gen_setup+0xa4/0x408 <-- CRASH + xhci_plat_setup+0x44/0x58 + usb_add_hcd+0x284/0x678 + ... + cdns_role_set+0x9c/0xbc <-- Role switch + +Fix by calling cdns_drd_gadget_off() in the error path to properly +clean up the DRD gadget state. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -3427,6 +3427,7 @@ static int __cdns3_gadget_init(struct cd + ret = cdns3_gadget_start(cdns); + if (ret) { + pm_runtime_put_sync(cdns->dev); ++ cdns_drd_gadget_off(cdns); + return ret; + } + diff --git a/queue-5.15/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch b/queue-5.15/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch new file mode 100644 index 0000000000..a7db2358ef --- /dev/null +++ b/queue-5.15/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch @@ -0,0 +1,45 @@ +From 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a Mon Sep 17 00:00:00 2001 +From: Juno Choi +Date: Tue, 24 Mar 2026 10:49:10 +0900 +Subject: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() + +From: Juno Choi + +commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream. + +dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, +which expects hsotg->lock to be held since it does spin_unlock/spin_lock +around the gadget driver callback invocation. + +However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() +without holding the lock. This leads to: + - spin_unlock on a lock that is not held (undefined behavior) + - The lock remaining held after dwc2_gadget_exit_clock_gating() returns, + causing a deadlock when spin_lock_irqsave() is called later in the + same function. + +Fix this by acquiring hsotg->lock before calling +dwc2_gadget_exit_clock_gating() and releasing it afterwards, which +satisfies the locking requirement of the call_gadget() macro. + +Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended") +Cc: stable +Signed-off-by: Juno Choi +Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4605,7 +4605,9 @@ static int dwc2_hsotg_udc_stop(struct us + /* Exit clock gating when driver is stopped. */ + if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE && + hsotg->bus_suspended && !hsotg->params.no_clock_gating) { ++ spin_lock_irqsave(&hsotg->lock, flags); + dwc2_gadget_exit_clock_gating(hsotg, 0); ++ spin_unlock_irqrestore(&hsotg->lock, flags); + } + + /* all endpoints should be shutdown */ diff --git a/queue-5.15/usb-ehci-brcm-fix-sleep-during-atomic.patch b/queue-5.15/usb-ehci-brcm-fix-sleep-during-atomic.patch new file mode 100644 index 0000000000..4fc670db96 --- /dev/null +++ b/queue-5.15/usb-ehci-brcm-fix-sleep-during-atomic.patch @@ -0,0 +1,37 @@ +From 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 18 Mar 2026 11:57:07 -0700 +Subject: usb: ehci-brcm: fix sleep during atomic + +From: Justin Chen + +commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream. + +echi_brcm_wait_for_sof() gets called after disabling interrupts +in ehci_brcm_hub_control(). Use the atomic version of poll_timeout +to fix the warning. + +Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's") +Cc: stable +Signed-off-by: Justin Chen +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ehci-brcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-brcm.c ++++ b/drivers/usb/host/ehci-brcm.c +@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so + int res; + + /* Wait for next microframe (every 125 usecs) */ +- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val, +- val != frame_idx, 1, 130); ++ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index, ++ val, val != frame_idx, 1, 130); + if (res) + ehci_err(ehci, "Error waiting for SOF\n"); + udelay(delay); diff --git a/queue-5.15/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch b/queue-5.15/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch new file mode 100644 index 0000000000..80d420d392 --- /dev/null +++ b/queue-5.15/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch @@ -0,0 +1,31 @@ +From dd36014ec6042f424ef51b923e607772f7502ee7 Mon Sep 17 00:00:00 2001 +From: Miao Li +Date: Thu, 19 Mar 2026 13:39:27 +0800 +Subject: usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive + +From: Miao Li + +commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream. + +Another Silicon Motion flash drive also randomly work incorrectly +(lsusb does not list the device) on Huawei hisi platforms during +500 reboot cycles, and the DELAY_INIT quirk fixes this issue. + +Signed-off-by: Miao Li +Cc: stable +Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -394,6 +394,7 @@ static const struct usb_device_id usb_qu + + /* Silicon Motion Flash Drive */ + { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Sound Devices USBPre2 */ + { USB_DEVICE(0x0926, 0x0202), .driver_info = diff --git a/queue-5.15/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch b/queue-5.15/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch new file mode 100644 index 0000000000..3a20d7f72a --- /dev/null +++ b/queue-5.15/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch @@ -0,0 +1,46 @@ +From 01af542392b5d41fd659d487015a71f627accce3 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Wed, 1 Apr 2026 10:51:42 +0800 +Subject: usb: ulpi: fix double free in ulpi_register_interface() error path + +From: Guangshuo Li + +commit 01af542392b5d41fd659d487015a71f627accce3 upstream. + +When device_register() fails, ulpi_register() calls put_device() on +ulpi->dev. + +The device release callback ulpi_dev_release() drops the OF node +reference and frees ulpi, but the current error path in +ulpi_register_interface() then calls kfree(ulpi) again, causing a +double free. + +Let put_device() handle the cleanup through ulpi_dev_release() and +avoid freeing ulpi again in ulpi_register_interface(). + +Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") +Cc: stable +Signed-off-by: Guangshuo Li +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/ulpi.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -286,10 +286,9 @@ struct ulpi *ulpi_register_interface(str + ulpi->ops = ops; + + ret = ulpi_register(dev, ulpi); +- if (ret) { +- kfree(ulpi); ++ if (ret) + return ERR_PTR(ret); +- } ++ + + return ulpi; + } diff --git a/queue-5.15/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch b/queue-5.15/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch new file mode 100644 index 0000000000..681c842a95 --- /dev/null +++ b/queue-5.15/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch @@ -0,0 +1,37 @@ +From 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Mon Sep 17 00:00:00 2001 +From: Heitor Alves de Siqueira +Date: Thu, 12 Mar 2026 09:27:28 -0300 +Subject: usb: usbtmc: Flush anchored URBs in usbtmc_release + +From: Heitor Alves de Siqueira + +commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream. + +When calling usbtmc_release, pending anchored URBs must be flushed or +killed to prevent use-after-free errors (e.g. in the HCD giveback +path). Call usbtmc_draw_down() to allow anchored URBs to be completed. + +Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file") +Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f +Cc: stable +Signed-off-by: Heitor Alves de Siqueira +Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode * + list_del(&file_data->file_elem); + + spin_unlock_irq(&file_data->data->dev_lock); ++ ++ /* flush anchored URBs */ ++ usbtmc_draw_down(file_data); + mutex_unlock(&file_data->data->io_mutex); + + kref_put(&file_data->data->kref, usbtmc_delete);