net-usb-kalmia-bound-rx-frame-length-in-kalmia_rx_fixup.patch
usb-cdc_acm-add-quirk-for-uniden-bc125at-scanner.patch
usb-core-add-usb_quirk_no_lpm-for-via-labs-usb-2.0-hub.patch
-usb-dwc3-meson-g12a-fix-refcount-leak-in-dwc3_meson_g12a_resume.patch
usb-gadget-composite-fix-dead-empty-check-in-the-usb_dt_otg-handler.patch
usb-idmouse-fix-use-after-free-on-disconnect-race.patch
usb-ldusb-fix-use-after-free-on-disconnect-race.patch
+++ /dev/null
-From 692c354bef03b77b30e57e61934da502c8a12d45 Mon Sep 17 00:00:00 2001
-From: WenTao Liang <vulab@iscas.ac.cn>
-Date: Thu, 11 Jun 2026 21:11:21 +0800
-Subject: usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
-
-From: WenTao Liang <vulab@iscas.ac.cn>
-
-commit 692c354bef03b77b30e57e61934da502c8a12d45 upstream.
-
-If dwc3_meson_g12a_resume() succeeds in calling
-reset_control_reset(), an internal triggered_count reference is
-acquired. If any later step fails (usb_init, phy_init,
-phy_power_on, regulator_enable, or usb_post_init), the function
-returns the error without rearming the reset control. This leaks
-the reference and leaves the reset control in a triggered state,
-causing future reset_control_reset() calls to incorrectly return
-early as if already reset.
-
-Add an error path that calls reset_control_rearm() to balance
-the reference before returning the error.
-
-Cc: stable <stable@kernel.org>
-Fixes: 5b0ba0caaf3a ("usb: dwc3: meson-g12a: refactor usb init")
-Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
-Link: https://patch.msgid.link/20260611131121.81784-1-vulab@iscas.ac.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +++++++++-----
- 1 file changed, 9 insertions(+), 5 deletions(-)
-
---- a/drivers/usb/dwc3/dwc3-meson-g12a.c
-+++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
-@@ -912,35 +912,39 @@ static int __maybe_unused dwc3_meson_g12
-
- ret = priv->drvdata->usb_init(priv);
- if (ret)
-- return ret;
-+ goto err_rearm;
-
- /* Init PHYs */
- for (i = 0 ; i < PHY_COUNT ; ++i) {
- ret = phy_init(priv->phys[i]);
- if (ret)
-- return ret;
-+ goto err_rearm;
- }
-
- /* Set PHY Power */
- for (i = 0 ; i < PHY_COUNT ; ++i) {
- ret = phy_power_on(priv->phys[i]);
- if (ret)
-- return ret;
-+ goto err_rearm;
- }
-
- if (priv->vbus && priv->otg_phy_mode == PHY_MODE_USB_HOST) {
- ret = regulator_enable(priv->vbus);
- if (ret)
-- return ret;
-+ goto err_rearm;
- }
-
- if (priv->drvdata->usb_post_init) {
- ret = priv->drvdata->usb_post_init(priv);
- if (ret)
-- return ret;
-+ goto err_rearm;
- }
-
- return 0;
-+
-+err_rearm:
-+ reset_control_rearm(priv->reset);
-+ return ret;
- }
-
- static const struct dev_pm_ops dwc3_meson_g12a_dev_pm_ops = {