--- /dev/null
+From 4f51e6c0baae80e52bd013092e82a55678be31fc Mon Sep 17 00:00:00 2001
+From: Valek Andrej <andrej.v@skyrain.eu>
+Date: Fri, 13 Mar 2026 10:24:13 +0100
+Subject: iio: accel: fix ADXL355 temperature signature value
+
+From: Valek Andrej <andrej.v@skyrain.eu>
+
+commit 4f51e6c0baae80e52bd013092e82a55678be31fc upstream.
+
+Temperature was wrongly represented as 12-bit signed, confirmed by checking
+the datasheet. Even if the temperature is negative, the value in the
+register stays unsigned.
+
+Fixes: 12ed27863ea3 iio: accel: Add driver support for ADXL355
+Signed-off-by: Valek Andrej <andrej.v@skyrain.eu>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/adxl355_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/adxl355_core.c
++++ b/drivers/iio/accel/adxl355_core.c
+@@ -699,7 +699,7 @@ static const struct iio_chan_spec adxl35
+ BIT(IIO_CHAN_INFO_OFFSET),
+ .scan_index = 3,
+ .scan_type = {
+- .sign = 's',
++ .sign = 'u',
+ .realbits = 12,
+ .storagebits = 16,
+ .endianness = IIO_BE,
--- /dev/null
+From c354521708175d776d896f8bdae44b18711eccb6 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Thu, 12 Mar 2026 13:20:24 +0200
+Subject: iio: dac: ad5770r: fix error return in ad5770r_read_raw()
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit c354521708175d776d896f8bdae44b18711eccb6 upstream.
+
+Return the error code from regmap_bulk_read() instead of 0 so
+that I/O failures are properly propagated.
+
+Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5770r.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ad5770r.c
++++ b/drivers/iio/dac/ad5770r.c
+@@ -323,7 +323,7 @@ static int ad5770r_read_raw(struct iio_d
+ chan->address,
+ st->transf_buf, 2);
+ if (ret)
+- return 0;
++ return ret;
+
+ buf16 = st->transf_buf[0] + (st->transf_buf[1] << 8);
+ *val = buf16 >> 2;
--- /dev/null
+From edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:15 -0600
+Subject: iio: gyro: mpu3050: Fix incorrect free_irq() variable
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream.
+
+The handler for the IRQ part of this driver is mpu3050->trig but,
+in the teardown free_irq() is called with handler mpu3050.
+
+Use correct IRQ handler when calling free_irq().
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1279,7 +1279,7 @@ void mpu3050_common_remove(struct device
+ pm_runtime_disable(dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+- free_irq(mpu3050->irq, mpu3050);
++ free_irq(mpu3050->irq, mpu3050->trig);
+ iio_device_unregister(indio_dev);
+ mpu3050_power_down(mpu3050);
+ }
--- /dev/null
+From 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:16 -0600
+Subject: iio: gyro: mpu3050: Fix irq resource leak
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream.
+
+The interrupt handler is setup but only a few lines down if
+iio_trigger_register() fails the function returns without properly
+releasing the handler.
+
+Add cleanup goto to resolve resource leak.
+
+Detected by Smatch:
+drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
+'irq' from request_threaded_irq() not released on lines: 1124.
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1139,11 +1139,16 @@ static int mpu3050_trigger_probe(struct
+
+ ret = iio_trigger_register(mpu3050->trig);
+ if (ret)
+- return ret;
++ goto err_iio_trigger;
+
+ indio_dev->trig = iio_trigger_get(mpu3050->trig);
+
+ return 0;
++
++err_iio_trigger:
++ free_irq(mpu3050->irq, mpu3050->trig);
++
++ return ret;
+ }
+
+ int mpu3050_common_probe(struct device *dev,
--- /dev/null
+From d14116f6529fa085b1a1b1f224dc9604e4d2a29c Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:18 -0600
+Subject: iio: gyro: mpu3050: Fix out-of-sequence free_irq()
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream.
+
+The triggered buffer is initialized before the IRQ is requested. The
+removal path currently calls iio_triggered_buffer_cleanup() before
+free_irq(). This violates the expected LIFO.
+
+Place free_irq() in the correct location relative to
+iio_triggered_buffer_cleanup().
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1288,9 +1288,9 @@ void mpu3050_common_remove(struct device
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+- iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
++ iio_triggered_buffer_cleanup(indio_dev);
+ mpu3050_power_down(mpu3050);
+ }
+
--- /dev/null
+From 4c05799449108fb0e0a6bd30e65fffc71e60db4d Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Tue, 24 Feb 2026 16:48:17 -0600
+Subject: iio: gyro: mpu3050: Move iio_device_register() to correct location
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream.
+
+iio_device_register() should be at the end of the probe function to
+prevent race conditions.
+
+Place iio_device_register() at the end of the probe function and place
+iio_device_unregister() accordingly.
+
+Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Suggested-by: Jonathan Cameron <jic23@kernel.org>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -1236,12 +1236,6 @@ int mpu3050_common_probe(struct device *
+ goto err_power_down;
+ }
+
+- ret = iio_device_register(indio_dev);
+- if (ret) {
+- dev_err(dev, "device register failed\n");
+- goto err_cleanup_buffer;
+- }
+-
+ dev_set_drvdata(dev, indio_dev);
+
+ /* Check if we have an assigned IRQ to use as trigger */
+@@ -1264,9 +1258,20 @@ int mpu3050_common_probe(struct device *
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_put(dev);
+
++ ret = iio_device_register(indio_dev);
++ if (ret) {
++ dev_err(dev, "device register failed\n");
++ goto err_iio_device_register;
++ }
++
+ return 0;
+
+-err_cleanup_buffer:
++err_iio_device_register:
++ pm_runtime_get_sync(dev);
++ pm_runtime_put_noidle(dev);
++ pm_runtime_disable(dev);
++ if (irq)
++ free_irq(mpu3050->irq, mpu3050->trig);
+ iio_triggered_buffer_cleanup(indio_dev);
+ err_power_down:
+ mpu3050_power_down(mpu3050);
+@@ -1279,13 +1284,13 @@ void mpu3050_common_remove(struct device
+ struct iio_dev *indio_dev = dev_get_drvdata(dev);
+ struct mpu3050 *mpu3050 = iio_priv(indio_dev);
+
++ iio_device_unregister(indio_dev);
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ if (mpu3050->irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
+- iio_device_unregister(indio_dev);
+ mpu3050_power_down(mpu3050);
+ }
+
--- /dev/null
+From c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+Date: Mon, 9 Mar 2026 20:45:45 -0700
+Subject: iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+commit c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 upstream.
+
+If 'pin' is not one of its expected values, the value of
+'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes
+Clang to generate undefined behavior, resulting in the following
+warning:
+
+ drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume()
+
+Prevent the UB and improve error handling by returning an error if 'pin'
+has an unexpected value.
+
+While at it, simplify the code a bit by moving the 'pin_name' assignment
+to the first switch statement.
+
+Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/bmi160/bmi160_core.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/drivers/iio/imu/bmi160/bmi160_core.c
++++ b/drivers/iio/imu/bmi160/bmi160_core.c
+@@ -568,12 +568,16 @@ static int bmi160_config_pin(struct regm
+ int_out_ctrl_shift = BMI160_INT1_OUT_CTRL_SHIFT;
+ int_latch_mask = BMI160_INT1_LATCH_MASK;
+ int_map_mask = BMI160_INT1_MAP_DRDY_EN;
++ pin_name = "INT1";
+ break;
+ case BMI160_PIN_INT2:
+ int_out_ctrl_shift = BMI160_INT2_OUT_CTRL_SHIFT;
+ int_latch_mask = BMI160_INT2_LATCH_MASK;
+ int_map_mask = BMI160_INT2_MAP_DRDY_EN;
++ pin_name = "INT2";
+ break;
++ default:
++ return -EINVAL;
+ }
+ int_out_ctrl_mask = BMI160_INT_OUT_CTRL_MASK << int_out_ctrl_shift;
+
+@@ -607,17 +611,8 @@ static int bmi160_config_pin(struct regm
+ ret = bmi160_write_conf_reg(regmap, BMI160_REG_INT_MAP,
+ int_map_mask, int_map_mask,
+ write_usleep);
+- if (ret) {
+- switch (pin) {
+- case BMI160_PIN_INT1:
+- pin_name = "INT1";
+- break;
+- case BMI160_PIN_INT2:
+- pin_name = "INT2";
+- break;
+- }
++ if (ret)
+ dev_err(dev, "Failed to configure %s IRQ pin", pin_name);
+- }
+
+ return ret;
+ }
--- /dev/null
+From 630748afa7030b272b7bee5df857e7bcf132ed51 Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <flavra@baylibre.com>
+Date: Wed, 25 Feb 2026 11:06:00 +0100
+Subject: iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
+
+From: Francesco Lavra <flavra@baylibre.com>
+
+commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream.
+
+The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and
+disabling the hardware FIFO, checks the contents of the hw->settings->batch
+array at index sensor->id, and then sets the current ODR value in sensor
+registers that depend on whether the register address is set in the above
+array element. This logic is valid for internal sensors only, i.e. the
+accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu:
+st_lsm6dsx: add i2c embedded controller support"), this function is called
+also when configuring the hardware FIFO for external sensors (i.e. sensors
+accessed through the sensor hub functionality), which can result in
+unrelated device registers being written.
+
+Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does
+not touch any registers unless it is called for internal sensors.
+
+Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
+Signed-off-by: Francesco Lavra <flavra@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+@@ -202,6 +202,10 @@ static int st_lsm6dsx_set_fifo_odr(struc
+ const struct st_lsm6dsx_reg *batch_reg;
+ u8 data;
+
++ /* Only internal sensors have a FIFO ODR configuration register. */
++ if (sensor->id >= ARRAY_SIZE(hw->settings->batch))
++ return 0;
++
+ batch_reg = &hw->settings->batch[sensor->id];
+ if (batch_reg->addr) {
+ int val;
--- /dev/null
+From fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Sat, 14 Mar 2026 17:18:10 -0500
+Subject: iio: light: vcnl4035: fix scan buffer on big-endian
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream.
+
+Rework vcnl4035_trigger_consumer_handler() so that we are not passing
+what should be a u16 value as an int * to regmap_read(). This won't
+work on bit endian systems.
+
+Instead, add a new unsigned int variable to pass to regmap_read(). Then
+copy that value into the buffer struct.
+
+The buffer array is replaced with a struct since there is only one value
+being read. This allows us to use the correct u16 data type and has a
+side-effect of simplifying the alignment specification.
+
+Also fix the endianness of the scan format from little-endian to CPU
+endianness. Since we are using regmap to read the value, it will be
+CPU-endian.
+
+Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/vcnl4035.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/light/vcnl4035.c
++++ b/drivers/iio/light/vcnl4035.c
+@@ -105,17 +105,23 @@ static irqreturn_t vcnl4035_trigger_cons
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct vcnl4035_data *data = iio_priv(indio_dev);
+ /* Ensure naturally aligned timestamp */
+- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { };
++ struct {
++ u16 als_data;
++ aligned_s64 timestamp;
++ } buffer = { };
++ unsigned int val;
+ int ret;
+
+- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer);
++ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val);
+ if (ret < 0) {
+ dev_err(&data->client->dev,
+ "Trigger consumer can't read from sensor.\n");
+ goto fail_read;
+ }
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+- iio_get_time_ns(indio_dev));
++
++ buffer.als_data = val;
++ iio_push_to_buffers_with_timestamp(indio_dev, &buffer,
++ iio_get_time_ns(indio_dev));
+
+ fail_read:
+ iio_trigger_notify_done(indio_dev->trig);
+@@ -378,7 +384,7 @@ static const struct iio_chan_spec vcnl40
+ .sign = 'u',
+ .realbits = 16,
+ .storagebits = 16,
+- .endianness = IIO_LE,
++ .endianness = IIO_CPU,
+ },
+ },
+ {
+@@ -392,7 +398,7 @@ static const struct iio_chan_spec vcnl40
+ .sign = 'u',
+ .realbits = 16,
+ .storagebits = 16,
+- .endianness = IIO_LE,
++ .endianness = IIO_CPU,
+ },
+ },
+ };
--- /dev/null
+From 5839419cffc7788a356428d321e3ec18055c0286 Mon Sep 17 00:00:00 2001
+From: Christoffer Sandberg <cs@tuxedo.de>
+Date: Mon, 23 Feb 2026 15:20:45 +0100
+Subject: Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+commit 5839419cffc7788a356428d321e3ec18055c0286 upstream.
+
+The device occasionally wakes up from suspend with missing input on the
+internal keyboard and the following suspend attempt results in an instant
+wake-up. The quirks fix both issues for this device.
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
--- /dev/null
+From 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 23 Feb 2026 15:05:15 -0800
+Subject: Input: synaptics-rmi4 - fix a locking bug in an error path
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream.
+
+Lock f54->data_mutex when entering the function statement since jumping
+to the 'error' label when checking report_size fails causes that mutex
+to be unlocked.
+
+This bug has been detected by the Clang thread-safety checker.
+
+Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/rmi4/rmi_f54.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_f54.c
++++ b/drivers/input/rmi4/rmi_f54.c
+@@ -540,6 +540,8 @@ static void rmi_f54_work(struct work_str
+ int error;
+ int i;
+
++ mutex_lock(&f54->data_mutex);
++
+ report_size = rmi_f54_get_report_size(f54);
+ if (report_size == 0) {
+ dev_err(&fn->dev, "Bad report size, report type=%d\n",
+@@ -548,8 +550,6 @@ static void rmi_f54_work(struct work_str
+ goto error; /* retry won't help */
+ }
+
+- mutex_lock(&f54->data_mutex);
+-
+ /*
+ * Need to check if command has completed.
+ * If not try again later.
--- /dev/null
+From e2b0ae529db4766584e77647cefe3ec15c3d842e Mon Sep 17 00:00:00 2001
+From: Zoltan Illes <zoliviragh@gmail.com>
+Date: Fri, 3 Apr 2026 22:03:42 -0700
+Subject: Input: xpad - add support for Razer Wolverine V3 Pro
+
+From: Zoltan Illes <zoliviragh@gmail.com>
+
+commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream.
+
+Add device IDs for the Razer Wolverine V3 Pro controller in both
+wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.
+
+The controller uses the Xbox 360 protocol (vendor-specific class,
+subclass 93, protocol 1) on interface 0 with an identical 20-byte
+input report layout, so no additional processing is needed.
+
+Signed-off-by: Zoltan Illes <zoliviragh@gmail.com>
+Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -289,6 +289,8 @@ static const struct xpad_device {
+ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
++ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 },
++ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
+ { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
usb-serial-option-add-support-for-rolling-wireless-rw135r-gl.patch
usb-core-add-no_lpm-quirk-for-razer-kiyo-pro-webcam.patch
iio-adc-ti-adc161s626-use-dma-safe-memory-for-spi_read.patch
+input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch
+input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch
+input-xpad-add-support-for-razer-wolverine-v3-pro.patch
+iio-accel-fix-adxl355-temperature-signature-value.patch
+iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch
+iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch
+iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch
+iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch
+iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch
+iio-gyro-mpu3050-fix-irq-resource-leak.patch
+iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch
+iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch
+usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch
+usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch
+usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch
+usb-ehci-brcm-fix-sleep-during-atomic.patch
+usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch
+usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch
+usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch
--- /dev/null
+From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001
+From: Yongchao Wu <yongchao.wu@autochips.com>
+Date: Tue, 31 Mar 2026 08:04:07 +0800
+Subject: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
+
+From: Yongchao Wu <yongchao.wu@autochips.com>
+
+commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream.
+
+When the gadget endpoint is disabled or not yet configured, the ep->desc
+pointer can be NULL. This leads to a NULL pointer dereference when
+__cdns3_gadget_ep_queue() is called, causing a kernel crash.
+
+Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
+standard return code for unconfigured endpoints.
+
+This prevents potential crashes when ep_queue is called on endpoints
+that are not ready.
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -2586,6 +2586,9 @@ static int __cdns3_gadget_ep_queue(struc
+ struct cdns3_request *priv_req;
+ int ret = 0;
+
++ if (!ep->desc)
++ return -ESHUTDOWN;
++
+ request->actual = 0;
+ request->status = -EINPROGRESS;
+ priv_req = to_cdns3_request(request);
--- /dev/null
+From c32f8748d70c8fc77676ad92ed76cede17bf2c48 Mon Sep 17 00:00:00 2001
+From: Yongchao Wu <yongchao.wu@autochips.com>
+Date: Wed, 1 Apr 2026 08:10:00 +0800
+Subject: usb: cdns3: gadget: fix state inconsistency on gadget init failure
+
+From: Yongchao Wu <yongchao.wu@autochips.com>
+
+commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream.
+
+When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode
+while software state remains INACTIVE, creating hardware/software state
+inconsistency.
+
+When switching to host mode via sysfs:
+ echo host > /sys/class/usb_role/13180000.usb-role-switch/role
+
+The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,
+so cdns_role_stop() skips cleanup because state is still INACTIVE.
+This violates the DRD controller design specification (Figure22),
+which requires returning to idle state before switching roles.
+
+This leads to a synchronous external abort in xhci_gen_setup() when
+setting up the host controller:
+
+[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19
+[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget
+[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed
+...
+[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
+[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
+[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408
+[ 1301.393391] backtrace:
+ ...
+ xhci_gen_setup+0xa4/0x408 <-- CRASH
+ xhci_plat_setup+0x44/0x58
+ usb_add_hcd+0x284/0x678
+ ...
+ cdns_role_set+0x9c/0xbc <-- Role switch
+
+Fix by calling cdns_drd_gadget_off() in the error path to properly
+clean up the DRD gadget state.
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -3427,6 +3427,7 @@ static int __cdns3_gadget_init(struct cd
+ ret = cdns3_gadget_start(cdns);
+ if (ret) {
+ pm_runtime_put_sync(cdns->dev);
++ cdns_drd_gadget_off(cdns);
+ return ret;
+ }
+
--- /dev/null
+From 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a Mon Sep 17 00:00:00 2001
+From: Juno Choi <juno.choi@lge.com>
+Date: Tue, 24 Mar 2026 10:49:10 +0900
+Subject: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
+
+From: Juno Choi <juno.choi@lge.com>
+
+commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream.
+
+dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,
+which expects hsotg->lock to be held since it does spin_unlock/spin_lock
+around the gadget driver callback invocation.
+
+However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()
+without holding the lock. This leads to:
+ - spin_unlock on a lock that is not held (undefined behavior)
+ - The lock remaining held after dwc2_gadget_exit_clock_gating() returns,
+ causing a deadlock when spin_lock_irqsave() is called later in the
+ same function.
+
+Fix this by acquiring hsotg->lock before calling
+dwc2_gadget_exit_clock_gating() and releasing it afterwards, which
+satisfies the locking requirement of the call_gadget() macro.
+
+Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Juno Choi <juno.choi@lge.com>
+Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4605,7 +4605,9 @@ static int dwc2_hsotg_udc_stop(struct us
+ /* Exit clock gating when driver is stopped. */
+ if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE &&
+ hsotg->bus_suspended && !hsotg->params.no_clock_gating) {
++ spin_lock_irqsave(&hsotg->lock, flags);
+ dwc2_gadget_exit_clock_gating(hsotg, 0);
++ spin_unlock_irqrestore(&hsotg->lock, flags);
+ }
+
+ /* all endpoints should be shutdown */
--- /dev/null
+From 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Mon Sep 17 00:00:00 2001
+From: Justin Chen <justin.chen@broadcom.com>
+Date: Wed, 18 Mar 2026 11:57:07 -0700
+Subject: usb: ehci-brcm: fix sleep during atomic
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream.
+
+echi_brcm_wait_for_sof() gets called after disabling interrupts
+in ehci_brcm_hub_control(). Use the atomic version of poll_timeout
+to fix the warning.
+
+Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ehci-brcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-brcm.c
++++ b/drivers/usb/host/ehci-brcm.c
+@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so
+ int res;
+
+ /* Wait for next microframe (every 125 usecs) */
+- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val,
+- val != frame_idx, 1, 130);
++ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index,
++ val, val != frame_idx, 1, 130);
+ if (res)
+ ehci_err(ehci, "Error waiting for SOF\n");
+ udelay(delay);
--- /dev/null
+From dd36014ec6042f424ef51b923e607772f7502ee7 Mon Sep 17 00:00:00 2001
+From: Miao Li <limiao@kylinos.cn>
+Date: Thu, 19 Mar 2026 13:39:27 +0800
+Subject: usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
+
+From: Miao Li <limiao@kylinos.cn>
+
+commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream.
+
+Another Silicon Motion flash drive also randomly work incorrectly
+(lsusb does not list the device) on Huawei hisi platforms during
+500 reboot cycles, and the DELAY_INIT quirk fixes this issue.
+
+Signed-off-by: Miao Li <limiao@kylinos.cn>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -402,6 +402,7 @@ static const struct usb_device_id usb_qu
+
+ /* Silicon Motion Flash Drive */
+ { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Sound Devices USBPre2 */
+ { USB_DEVICE(0x0926, 0x0202), .driver_info =
--- /dev/null
+From 01af542392b5d41fd659d487015a71f627accce3 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Wed, 1 Apr 2026 10:51:42 +0800
+Subject: usb: ulpi: fix double free in ulpi_register_interface() error path
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 01af542392b5d41fd659d487015a71f627accce3 upstream.
+
+When device_register() fails, ulpi_register() calls put_device() on
+ulpi->dev.
+
+The device release callback ulpi_dev_release() drops the OF node
+reference and frees ulpi, but the current error path in
+ulpi_register_interface() then calls kfree(ulpi) again, causing a
+double free.
+
+Let put_device() handle the cleanup through ulpi_dev_release() and
+avoid freeing ulpi again in ulpi_register_interface().
+
+Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/common/ulpi.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(str
+ ulpi->ops = ops;
+
+ ret = ulpi_register(dev, ulpi);
+- if (ret) {
+- kfree(ulpi);
++ if (ret)
+ return ERR_PTR(ret);
+- }
++
+
+ return ulpi;
+ }
--- /dev/null
+From 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Mon Sep 17 00:00:00 2001
+From: Heitor Alves de Siqueira <halves@igalia.com>
+Date: Thu, 12 Mar 2026 09:27:28 -0300
+Subject: usb: usbtmc: Flush anchored URBs in usbtmc_release
+
+From: Heitor Alves de Siqueira <halves@igalia.com>
+
+commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream.
+
+When calling usbtmc_release, pending anchored URBs must be flushed or
+killed to prevent use-after-free errors (e.g. in the HCD giveback
+path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
+
+Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file")
+Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f
+Cc: stable <stable@kernel.org>
+Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
+Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/usbtmc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode *
+ list_del(&file_data->file_elem);
+
+ spin_unlock_irq(&file_data->data->dev_lock);
++
++ /* flush anchored URBs */
++ usbtmc_draw_down(file_data);
+ mutex_unlock(&file_data->data->io_mutex);
+
+ kref_put(&file_data->data->kref, usbtmc_delete);
projects / thirdparty / kernel / stable-queue.git / commitdiff
