From: Greg Kroah-Hartman Date: Tue, 7 Apr 2026 15:34:48 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0e2e92b5a2b3289f6cc9d22f53d3c0208f18d8fb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch iio-accel-fix-adxl355-temperature-signature-value.patch iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch iio-gyro-mpu3050-fix-irq-resource-leak.patch iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch input-bcm5974-recover-from-failed-mode-switch.patch input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch input-xpad-add-support-for-razer-wolverine-v3-pro.patch usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch usb-core-phy-avoid-double-use-of-usb3-phy.patch usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch usb-ehci-brcm-fix-sleep-during-atomic.patch usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch --- diff --git a/queue-6.12/iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch b/queue-6.12/iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch new file mode 100644 index 0000000000..9b0efbf14e --- /dev/null +++ b/queue-6.12/iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch @@ -0,0 +1,33 @@ +From bd66aa1c8b8cabf459064a46d3430a5ec5138418 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Fri, 27 Feb 2026 14:43:05 +0200 +Subject: iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 + +From: Antoniu Miclaus + +commit bd66aa1c8b8cabf459064a46d3430a5ec5138418 upstream. + +FIELD_PREP(BIT(0), fifo_samples & BIT(8)) produces either 0 or 256, +and since FIELD_PREP masks to bit 0, 256 & 1 evaluates to 0. Use !! +to convert the result to a proper 0-or-1 value. + +Fixes: df36de13677a ("iio: accel: add ADXL380 driver") +Signed-off-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/adxl380.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/adxl380.c ++++ b/drivers/iio/accel/adxl380.c +@@ -888,7 +888,7 @@ static int adxl380_set_fifo_samples(stru + ret = regmap_update_bits(st->regmap, ADXL380_FIFO_CONFIG_0_REG, + ADXL380_FIFO_SAMPLES_8_MSK, + FIELD_PREP(ADXL380_FIFO_SAMPLES_8_MSK, +- (fifo_samples & BIT(8)))); ++ !!(fifo_samples & BIT(8)))); + if (ret) + return ret; + diff --git a/queue-6.12/iio-accel-fix-adxl355-temperature-signature-value.patch b/queue-6.12/iio-accel-fix-adxl355-temperature-signature-value.patch new file mode 100644 index 0000000000..c34712d0ae --- /dev/null +++ b/queue-6.12/iio-accel-fix-adxl355-temperature-signature-value.patch @@ -0,0 +1,33 @@ +From 4f51e6c0baae80e52bd013092e82a55678be31fc Mon Sep 17 00:00:00 2001 +From: Valek Andrej +Date: Fri, 13 Mar 2026 10:24:13 +0100 +Subject: iio: accel: fix ADXL355 temperature signature value + +From: Valek Andrej + +commit 4f51e6c0baae80e52bd013092e82a55678be31fc upstream. + +Temperature was wrongly represented as 12-bit signed, confirmed by checking +the datasheet. Even if the temperature is negative, the value in the +register stays unsigned. + +Fixes: 12ed27863ea3 iio: accel: Add driver support for ADXL355 +Signed-off-by: Valek Andrej +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/adxl355_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/adxl355_core.c ++++ b/drivers/iio/accel/adxl355_core.c +@@ -745,7 +745,7 @@ static const struct iio_chan_spec adxl35 + BIT(IIO_CHAN_INFO_OFFSET), + .scan_index = 3, + .scan_type = { +- .sign = 's', ++ .sign = 'u', + .realbits = 12, + .storagebits = 16, + .endianness = IIO_BE, diff --git a/queue-6.12/iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch b/queue-6.12/iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch new file mode 100644 index 0000000000..08cc7ab3bc --- /dev/null +++ b/queue-6.12/iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch @@ -0,0 +1,32 @@ +From 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 Mon Sep 17 00:00:00 2001 +From: Billy Tsai +Date: Tue, 3 Mar 2026 10:38:26 +0800 +Subject: iio: adc: aspeed: clear reference voltage bits before configuring vref + +From: Billy Tsai + +commit 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 upstream. + +Ensures the reference voltage bits are cleared in the ADC engine +control register before configuring the voltage reference. This +avoids potential misconfigurations caused by residual bits. + +Fixes: 1b5ceb55fec2 ("iio: adc: aspeed: Support ast2600 adc.") +Signed-off-by: Billy Tsai +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/aspeed_adc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/aspeed_adc.c ++++ b/drivers/iio/adc/aspeed_adc.c +@@ -415,6 +415,7 @@ static int aspeed_adc_vref_config(struct + } + adc_engine_control_reg_val = + readl(data->base + ASPEED_REG_ENGINE_CONTROL); ++ adc_engine_control_reg_val &= ~ASPEED_ADC_REF_VOLTAGE; + + ret = devm_regulator_get_enable_read_voltage(data->dev, "vref"); + if (ret < 0 && ret != -ENODEV) diff --git a/queue-6.12/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch b/queue-6.12/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch new file mode 100644 index 0000000000..08bff67cc3 --- /dev/null +++ b/queue-6.12/iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch @@ -0,0 +1,32 @@ +From c354521708175d776d896f8bdae44b18711eccb6 Mon Sep 17 00:00:00 2001 +From: Antoniu Miclaus +Date: Thu, 12 Mar 2026 13:20:24 +0200 +Subject: iio: dac: ad5770r: fix error return in ad5770r_read_raw() + +From: Antoniu Miclaus + +commit c354521708175d776d896f8bdae44b18711eccb6 upstream. + +Return the error code from regmap_bulk_read() instead of 0 so +that I/O failures are properly propagated. + +Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support") +Signed-off-by: Antoniu Miclaus +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5770r.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5770r.c ++++ b/drivers/iio/dac/ad5770r.c +@@ -323,7 +323,7 @@ static int ad5770r_read_raw(struct iio_d + chan->address, + st->transf_buf, 2); + if (ret) +- return 0; ++ return ret; + + buf16 = st->transf_buf[0] + (st->transf_buf[1] << 8); + *val = buf16 >> 2; diff --git a/queue-6.12/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch b/queue-6.12/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch new file mode 100644 index 0000000000..43fbe53c53 --- /dev/null +++ b/queue-6.12/iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch @@ -0,0 +1,36 @@ +From edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:15 -0600 +Subject: iio: gyro: mpu3050: Fix incorrect free_irq() variable + +From: Ethan Tidmore + +commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream. + +The handler for the IRQ part of this driver is mpu3050->trig but, +in the teardown free_irq() is called with handler mpu3050. + +Use correct IRQ handler when calling free_irq(). + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1272,7 +1272,7 @@ void mpu3050_common_remove(struct device + pm_runtime_disable(dev); + iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) +- free_irq(mpu3050->irq, mpu3050); ++ free_irq(mpu3050->irq, mpu3050->trig); + iio_device_unregister(indio_dev); + mpu3050_power_down(mpu3050); + } diff --git a/queue-6.12/iio-gyro-mpu3050-fix-irq-resource-leak.patch b/queue-6.12/iio-gyro-mpu3050-fix-irq-resource-leak.patch new file mode 100644 index 0000000000..32eedbbd37 --- /dev/null +++ b/queue-6.12/iio-gyro-mpu3050-fix-irq-resource-leak.patch @@ -0,0 +1,50 @@ +From 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:16 -0600 +Subject: iio: gyro: mpu3050: Fix irq resource leak + +From: Ethan Tidmore + +commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream. + +The interrupt handler is setup but only a few lines down if +iio_trigger_register() fails the function returns without properly +releasing the handler. + +Add cleanup goto to resolve resource leak. + +Detected by Smatch: +drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn: +'irq' from request_threaded_irq() not released on lines: 1124. + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1132,11 +1132,16 @@ static int mpu3050_trigger_probe(struct + + ret = iio_trigger_register(mpu3050->trig); + if (ret) +- return ret; ++ goto err_iio_trigger; + + indio_dev->trig = iio_trigger_get(mpu3050->trig); + + return 0; ++ ++err_iio_trigger: ++ free_irq(mpu3050->irq, mpu3050->trig); ++ ++ return ret; + } + + int mpu3050_common_probe(struct device *dev, diff --git a/queue-6.12/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch b/queue-6.12/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch new file mode 100644 index 0000000000..f470571c75 --- /dev/null +++ b/queue-6.12/iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch @@ -0,0 +1,41 @@ +From d14116f6529fa085b1a1b1f224dc9604e4d2a29c Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:18 -0600 +Subject: iio: gyro: mpu3050: Fix out-of-sequence free_irq() + +From: Ethan Tidmore + +commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream. + +The triggered buffer is initialized before the IRQ is requested. The +removal path currently calls iio_triggered_buffer_cleanup() before +free_irq(). This violates the expected LIFO. + +Place free_irq() in the correct location relative to +iio_triggered_buffer_cleanup(). + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Suggested-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1281,9 +1281,9 @@ void mpu3050_common_remove(struct device + pm_runtime_get_sync(dev); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); +- iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) + free_irq(mpu3050->irq, mpu3050->trig); ++ iio_triggered_buffer_cleanup(indio_dev); + mpu3050_power_down(mpu3050); + } + diff --git a/queue-6.12/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch b/queue-6.12/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch new file mode 100644 index 0000000000..8729bfc9ac --- /dev/null +++ b/queue-6.12/iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch @@ -0,0 +1,79 @@ +From 4c05799449108fb0e0a6bd30e65fffc71e60db4d Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Tue, 24 Feb 2026 16:48:17 -0600 +Subject: iio: gyro: mpu3050: Move iio_device_register() to correct location + +From: Ethan Tidmore + +commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream. + +iio_device_register() should be at the end of the probe function to +prevent race conditions. + +Place iio_device_register() at the end of the probe function and place +iio_device_unregister() accordingly. + +Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Suggested-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Signed-off-by: Ethan Tidmore +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -1229,12 +1229,6 @@ int mpu3050_common_probe(struct device * + goto err_power_down; + } + +- ret = iio_device_register(indio_dev); +- if (ret) { +- dev_err(dev, "device register failed\n"); +- goto err_cleanup_buffer; +- } +- + dev_set_drvdata(dev, indio_dev); + + /* Check if we have an assigned IRQ to use as trigger */ +@@ -1257,9 +1251,20 @@ int mpu3050_common_probe(struct device * + pm_runtime_use_autosuspend(dev); + pm_runtime_put(dev); + ++ ret = iio_device_register(indio_dev); ++ if (ret) { ++ dev_err(dev, "device register failed\n"); ++ goto err_iio_device_register; ++ } ++ + return 0; + +-err_cleanup_buffer: ++err_iio_device_register: ++ pm_runtime_get_sync(dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_disable(dev); ++ if (irq) ++ free_irq(mpu3050->irq, mpu3050->trig); + iio_triggered_buffer_cleanup(indio_dev); + err_power_down: + mpu3050_power_down(mpu3050); +@@ -1272,13 +1277,13 @@ void mpu3050_common_remove(struct device + struct iio_dev *indio_dev = dev_get_drvdata(dev); + struct mpu3050 *mpu3050 = iio_priv(indio_dev); + ++ iio_device_unregister(indio_dev); + pm_runtime_get_sync(dev); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); + iio_triggered_buffer_cleanup(indio_dev); + if (mpu3050->irq) + free_irq(mpu3050->irq, mpu3050->trig); +- iio_device_unregister(indio_dev); + mpu3050_power_down(mpu3050); + } + diff --git a/queue-6.12/iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch b/queue-6.12/iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch new file mode 100644 index 0000000000..0e482a4bd4 --- /dev/null +++ b/queue-6.12/iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch @@ -0,0 +1,76 @@ +From c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Mon, 9 Mar 2026 20:45:45 -0700 +Subject: iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Josh Poimboeuf + +commit c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 upstream. + +If 'pin' is not one of its expected values, the value of +'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes +Clang to generate undefined behavior, resulting in the following +warning: + + drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume() + +Prevent the UB and improve error handling by returning an error if 'pin' +has an unexpected value. + +While at it, simplify the code a bit by moving the 'pin_name' assignment +to the first switch statement. + +Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support") +Reported-by: Arnd Bergmann +Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com +Signed-off-by: Josh Poimboeuf +Reviewed-by: Nuno Sá +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/bmi160/bmi160_core.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +--- a/drivers/iio/imu/bmi160/bmi160_core.c ++++ b/drivers/iio/imu/bmi160/bmi160_core.c +@@ -573,12 +573,16 @@ static int bmi160_config_pin(struct regm + int_out_ctrl_shift = BMI160_INT1_OUT_CTRL_SHIFT; + int_latch_mask = BMI160_INT1_LATCH_MASK; + int_map_mask = BMI160_INT1_MAP_DRDY_EN; ++ pin_name = "INT1"; + break; + case BMI160_PIN_INT2: + int_out_ctrl_shift = BMI160_INT2_OUT_CTRL_SHIFT; + int_latch_mask = BMI160_INT2_LATCH_MASK; + int_map_mask = BMI160_INT2_MAP_DRDY_EN; ++ pin_name = "INT2"; + break; ++ default: ++ return -EINVAL; + } + int_out_ctrl_mask = BMI160_INT_OUT_CTRL_MASK << int_out_ctrl_shift; + +@@ -612,17 +616,8 @@ static int bmi160_config_pin(struct regm + ret = bmi160_write_conf_reg(regmap, BMI160_REG_INT_MAP, + int_map_mask, int_map_mask, + write_usleep); +- if (ret) { +- switch (pin) { +- case BMI160_PIN_INT1: +- pin_name = "INT1"; +- break; +- case BMI160_PIN_INT2: +- pin_name = "INT2"; +- break; +- } ++ if (ret) + dev_err(dev, "Failed to configure %s IRQ pin", pin_name); +- } + + return ret; + } diff --git a/queue-6.12/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch b/queue-6.12/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch new file mode 100644 index 0000000000..b6c5763849 --- /dev/null +++ b/queue-6.12/iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch @@ -0,0 +1,45 @@ +From 630748afa7030b272b7bee5df857e7bcf132ed51 Mon Sep 17 00:00:00 2001 +From: Francesco Lavra +Date: Wed, 25 Feb 2026 11:06:00 +0100 +Subject: iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only + +From: Francesco Lavra + +commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream. + +The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and +disabling the hardware FIFO, checks the contents of the hw->settings->batch +array at index sensor->id, and then sets the current ODR value in sensor +registers that depend on whether the register address is set in the above +array element. This logic is valid for internal sensors only, i.e. the +accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu: +st_lsm6dsx: add i2c embedded controller support"), this function is called +also when configuring the hardware FIFO for external sensors (i.e. sensors +accessed through the sensor hub functionality), which can result in +unrelated device registers being written. + +Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does +not touch any registers unless it is called for internal sensors. + +Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") +Signed-off-by: Francesco Lavra +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +@@ -224,6 +224,10 @@ static int st_lsm6dsx_set_fifo_odr(struc + const struct st_lsm6dsx_reg *batch_reg; + u8 data; + ++ /* Only internal sensors have a FIFO ODR configuration register. */ ++ if (sensor->id >= ARRAY_SIZE(hw->settings->batch)) ++ return 0; ++ + batch_reg = &hw->settings->batch[sensor->id]; + if (batch_reg->addr) { + int val; diff --git a/queue-6.12/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch b/queue-6.12/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch new file mode 100644 index 0000000000..3bc0183814 --- /dev/null +++ b/queue-6.12/iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch @@ -0,0 +1,81 @@ +From fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Sat, 14 Mar 2026 17:18:10 -0500 +Subject: iio: light: vcnl4035: fix scan buffer on big-endian + +From: David Lechner + +commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream. + +Rework vcnl4035_trigger_consumer_handler() so that we are not passing +what should be a u16 value as an int * to regmap_read(). This won't +work on bit endian systems. + +Instead, add a new unsigned int variable to pass to regmap_read(). Then +copy that value into the buffer struct. + +The buffer array is replaced with a struct since there is only one value +being read. This allows us to use the correct u16 data type and has a +side-effect of simplifying the alignment specification. + +Also fix the endianness of the scan format from little-endian to CPU +endianness. Since we are using regmap to read the value, it will be +CPU-endian. + +Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") +Signed-off-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/vcnl4035.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -105,17 +105,23 @@ static irqreturn_t vcnl4035_trigger_cons + struct iio_dev *indio_dev = pf->indio_dev; + struct vcnl4035_data *data = iio_priv(indio_dev); + /* Ensure naturally aligned timestamp */ +- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; ++ struct { ++ u16 als_data; ++ aligned_s64 timestamp; ++ } buffer = { }; ++ unsigned int val; + int ret; + +- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); ++ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val); + if (ret < 0) { + dev_err(&data->client->dev, + "Trigger consumer can't read from sensor.\n"); + goto fail_read; + } +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, +- iio_get_time_ns(indio_dev)); ++ ++ buffer.als_data = val; ++ iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ++ iio_get_time_ns(indio_dev)); + + fail_read: + iio_trigger_notify_done(indio_dev->trig); +@@ -378,7 +384,7 @@ static const struct iio_chan_spec vcnl40 + .sign = 'u', + .realbits = 16, + .storagebits = 16, +- .endianness = IIO_LE, ++ .endianness = IIO_CPU, + }, + }, + { +@@ -392,7 +398,7 @@ static const struct iio_chan_spec vcnl40 + .sign = 'u', + .realbits = 16, + .storagebits = 16, +- .endianness = IIO_LE, ++ .endianness = IIO_CPU, + }, + }, + }; diff --git a/queue-6.12/input-bcm5974-recover-from-failed-mode-switch.patch b/queue-6.12/input-bcm5974-recover-from-failed-mode-switch.patch new file mode 100644 index 0000000000..8ee702d2eb --- /dev/null +++ b/queue-6.12/input-bcm5974-recover-from-failed-mode-switch.patch @@ -0,0 +1,110 @@ +From fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda Mon Sep 17 00:00:00 2001 +From: Liam Mitchell +Date: Wed, 18 Feb 2026 14:21:35 -0800 +Subject: Input: bcm5974 - recover from failed mode switch + +From: Liam Mitchell + +commit fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda upstream. + +Mode switches sent before control response are ignored. This results in +an unresponsive trackpad and "bcm5974: bad trackpad package, length: 8" +repeated in logs. + +On receiving unknown 8-byte packets, assume that mode switch was ignored +and schedule an asynchronous mode reset. The reset will switch the +device to normal mode, wait, then switch back to wellspring mode. + +Signed-off-by: Liam Mitchell +Link: https://lore.kernel.org/linux-input/CAOQ1CL4+DP1TuLAGNsz5GdFBTHvnTg=5q=Dr2Z1OQc6RXydSYA@mail.gmail.com/ +Acked-by: Henrik Rydberg +Link: https://patch.msgid.link/20260213-bcm5974-reset-v2-1-1837851336b0@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/bcm5974.c | 42 +++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +--- a/drivers/input/mouse/bcm5974.c ++++ b/drivers/input/mouse/bcm5974.c +@@ -286,6 +286,8 @@ struct bcm5974 { + const struct tp_finger *index[MAX_FINGERS]; /* finger index data */ + struct input_mt_pos pos[MAX_FINGERS]; /* position array */ + int slots[MAX_FINGERS]; /* slot assignments */ ++ struct work_struct mode_reset_work; ++ unsigned long last_mode_reset; + }; + + /* trackpad finger block data, le16-aligned */ +@@ -696,6 +698,32 @@ static int bcm5974_wellspring_mode(struc + return retval; + } + ++/* ++ * Mode switches sent before the control response are ignored. ++ * Fixing this state requires switching to normal mode and waiting ++ * about 1ms before switching back to wellspring mode. ++ */ ++static void bcm5974_mode_reset_work(struct work_struct *work) ++{ ++ struct bcm5974 *dev = container_of(work, struct bcm5974, mode_reset_work); ++ int error; ++ ++ guard(mutex)(&dev->pm_mutex); ++ dev->last_mode_reset = jiffies; ++ ++ error = bcm5974_wellspring_mode(dev, false); ++ if (error) { ++ dev_err(&dev->intf->dev, "reset to normal mode failed\n"); ++ return; ++ } ++ ++ fsleep(1000); ++ ++ error = bcm5974_wellspring_mode(dev, true); ++ if (error) ++ dev_err(&dev->intf->dev, "mode switch after reset failed\n"); ++} ++ + static void bcm5974_irq_button(struct urb *urb) + { + struct bcm5974 *dev = urb->context; +@@ -752,10 +780,20 @@ static void bcm5974_irq_trackpad(struct + if (dev->tp_urb->actual_length == 2) + goto exit; + +- if (report_tp_state(dev, dev->tp_urb->actual_length)) ++ if (report_tp_state(dev, dev->tp_urb->actual_length)) { + dprintk(1, "bcm5974: bad trackpad package, length: %d\n", + dev->tp_urb->actual_length); + ++ /* ++ * Receiving a HID packet means we aren't in wellspring mode. ++ * If we haven't tried a reset in the last second, try now. ++ */ ++ if (dev->tp_urb->actual_length == 8 && ++ time_after(jiffies, dev->last_mode_reset + msecs_to_jiffies(1000))) { ++ schedule_work(&dev->mode_reset_work); ++ } ++ } ++ + exit: + error = usb_submit_urb(dev->tp_urb, GFP_ATOMIC); + if (error) +@@ -906,6 +944,7 @@ static int bcm5974_probe(struct usb_inte + dev->intf = iface; + dev->input = input_dev; + dev->cfg = *cfg; ++ INIT_WORK(&dev->mode_reset_work, bcm5974_mode_reset_work); + mutex_init(&dev->pm_mutex); + + /* setup urbs */ +@@ -998,6 +1037,7 @@ static void bcm5974_disconnect(struct us + { + struct bcm5974 *dev = usb_get_intfdata(iface); + ++ disable_work_sync(&dev->mode_reset_work); + usb_set_intfdata(iface, NULL); + + input_unregister_device(dev->input); diff --git a/queue-6.12/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch b/queue-6.12/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch new file mode 100644 index 0000000000..7813647699 --- /dev/null +++ b/queue-6.12/input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch @@ -0,0 +1,39 @@ +From 5839419cffc7788a356428d321e3ec18055c0286 Mon Sep 17 00:00:00 2001 +From: Christoffer Sandberg +Date: Mon, 23 Feb 2026 15:20:45 +0100 +Subject: Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table + +From: Christoffer Sandberg + +commit 5839419cffc7788a356428d321e3ec18055c0286 upstream. + +The device occasionally wakes up from suspend with missing input on the +internal keyboard and the following suspend attempt results in an instant +wake-up. The quirks fix both issues for this device. + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_ + }, + { + .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | diff --git a/queue-6.12/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch b/queue-6.12/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch new file mode 100644 index 0000000000..4c4a7f4213 --- /dev/null +++ b/queue-6.12/input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch @@ -0,0 +1,45 @@ +From 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 23 Feb 2026 15:05:15 -0800 +Subject: Input: synaptics-rmi4 - fix a locking bug in an error path + +From: Bart Van Assche + +commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream. + +Lock f54->data_mutex when entering the function statement since jumping +to the 'error' label when checking report_size fails causes that mutex +to be unlocked. + +This bug has been detected by the Clang thread-safety checker. + +Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics") +Signed-off-by: Bart Van Assche +Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/rmi4/rmi_f54.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/input/rmi4/rmi_f54.c ++++ b/drivers/input/rmi4/rmi_f54.c +@@ -540,6 +540,8 @@ static void rmi_f54_work(struct work_str + int error; + int i; + ++ mutex_lock(&f54->data_mutex); ++ + report_size = rmi_f54_get_report_size(f54); + if (report_size == 0) { + dev_err(&fn->dev, "Bad report size, report type=%d\n", +@@ -548,8 +550,6 @@ static void rmi_f54_work(struct work_str + goto error; /* retry won't help */ + } + +- mutex_lock(&f54->data_mutex); +- + /* + * Need to check if command has completed. + * If not try again later. diff --git a/queue-6.12/input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch b/queue-6.12/input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch new file mode 100644 index 0000000000..d53f746b8f --- /dev/null +++ b/queue-6.12/input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch @@ -0,0 +1,41 @@ +From 0d9363a764d9d601a05591f9695cea8b429e9be3 Mon Sep 17 00:00:00 2001 +From: Shengyu Qu +Date: Fri, 3 Apr 2026 22:07:28 -0700 +Subject: Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode + +From: Shengyu Qu + +commit 0d9363a764d9d601a05591f9695cea8b429e9be3 upstream. + +BETOP's BTP-KP50B and BTP-KP50C controller's wireless dongles are both +working as standard Xbox 360 controllers. Add USB device IDs for them to +xpad driver. + +Signed-off-by: Shengyu Qu +Link: https://patch.msgid.link/TY4PR01MB14432B4B298EA186E5F86C46B9855A@TY4PR01MB14432.jpnprd01.prod.outlook.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -354,6 +354,8 @@ static const struct xpad_device { + { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, + { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 }, ++ { 0x20bc, 0x5134, "BETOP BTP-KP50B Xinput Dongle", 0, XTYPE_XBOX360 }, ++ { 0x20bc, 0x514a, "BETOP BTP-KP50C Xinput Dongle", 0, XTYPE_XBOX360 }, + { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x2064, "PowerA Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, +@@ -548,6 +550,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ + XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */ ++ XPAD_XBOX360_VENDOR(0x20bc), /* BETOP wireless dongles */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOX360_VENDOR(0x2345), /* Machenike Controllers */ diff --git a/queue-6.12/input-xpad-add-support-for-razer-wolverine-v3-pro.patch b/queue-6.12/input-xpad-add-support-for-razer-wolverine-v3-pro.patch new file mode 100644 index 0000000000..21f99172e5 --- /dev/null +++ b/queue-6.12/input-xpad-add-support-for-razer-wolverine-v3-pro.patch @@ -0,0 +1,36 @@ +From e2b0ae529db4766584e77647cefe3ec15c3d842e Mon Sep 17 00:00:00 2001 +From: Zoltan Illes +Date: Fri, 3 Apr 2026 22:03:42 -0700 +Subject: Input: xpad - add support for Razer Wolverine V3 Pro + +From: Zoltan Illes + +commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream. + +Add device IDs for the Razer Wolverine V3 Pro controller in both +wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes. + +The controller uses the Xbox 360 protocol (vendor-specific class, +subclass 93, protocol 1) on interface 0 with an identical 20-byte +input report layout, so no additional processing is needed. + +Signed-off-by: Zoltan Illes +Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -307,6 +307,8 @@ static const struct xpad_device { + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 }, ++ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, diff --git a/queue-6.12/series b/queue-6.12/series index 5d59e7c72a..52e7d57be9 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -147,3 +147,27 @@ drm-amdgpu-pm-drop-smu-driver-if-version-not-matched-messages.patch usb-serial-io_edgeport-add-support-for-blackbox-ic135a.patch usb-serial-option-add-support-for-rolling-wireless-rw135r-gl.patch usb-core-add-no_lpm-quirk-for-razer-kiyo-pro-webcam.patch +input-synaptics-rmi4-fix-a-locking-bug-in-an-error-path.patch +input-i8042-add-tuxedo-infinitybook-max-16-gen10-amd-to-i8042-quirk-table.patch +input-bcm5974-recover-from-failed-mode-switch.patch +input-xpad-add-support-for-betop-btp-kp50b-c-controller-s-wireless-mode.patch +input-xpad-add-support-for-razer-wolverine-v3-pro.patch +iio-adc-aspeed-clear-reference-voltage-bits-before-configuring-vref.patch +iio-accel-fix-adxl355-temperature-signature-value.patch +iio-accel-adxl380-fix-fifo-watermark-bit-8-always-written-as-0.patch +iio-dac-ad5770r-fix-error-return-in-ad5770r_read_raw.patch +iio-light-vcnl4035-fix-scan-buffer-on-big-endian.patch +iio-imu-bmi160-remove-potential-undefined-behavior-in-bmi160_config_pin.patch +iio-imu-st_lsm6dsx-set-fifo-odr-for-accelerometer-and-gyroscope-only.patch +iio-gyro-mpu3050-fix-incorrect-free_irq-variable.patch +iio-gyro-mpu3050-fix-irq-resource-leak.patch +iio-gyro-mpu3050-move-iio_device_register-to-correct-location.patch +iio-gyro-mpu3050-fix-out-of-sequence-free_irq.patch +usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch +usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch +usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch +usb-ehci-brcm-fix-sleep-during-atomic.patch +usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch +usb-core-phy-avoid-double-use-of-usb3-phy.patch +usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch +usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch diff --git a/queue-6.12/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch b/queue-6.12/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch new file mode 100644 index 0000000000..2e38a04156 --- /dev/null +++ b/queue-6.12/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch @@ -0,0 +1,41 @@ +From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Tue, 31 Mar 2026 08:04:07 +0800 +Subject: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue + +From: Yongchao Wu + +commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream. + +When the gadget endpoint is disabled or not yet configured, the ep->desc +pointer can be NULL. This leads to a NULL pointer dereference when +__cdns3_gadget_ep_queue() is called, causing a kernel crash. + +Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the +standard return code for unconfigured endpoints. + +This prevents potential crashes when ep_queue is called on endpoints +that are not ready. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struc + struct cdns3_request *priv_req; + int ret = 0; + ++ if (!ep->desc) ++ return -ESHUTDOWN; ++ + request->actual = 0; + request->status = -EINPROGRESS; + priv_req = to_cdns3_request(request); diff --git a/queue-6.12/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch b/queue-6.12/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch new file mode 100644 index 0000000000..134350c31f --- /dev/null +++ b/queue-6.12/usb-cdns3-gadget-fix-state-inconsistency-on-gadget-init-failure.patch @@ -0,0 +1,62 @@ +From c32f8748d70c8fc77676ad92ed76cede17bf2c48 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Wed, 1 Apr 2026 08:10:00 +0800 +Subject: usb: cdns3: gadget: fix state inconsistency on gadget init failure + +From: Yongchao Wu + +commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 upstream. + +When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode +while software state remains INACTIVE, creating hardware/software state +inconsistency. + +When switching to host mode via sysfs: + echo host > /sys/class/usb_role/13180000.usb-role-switch/role + +The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, +so cdns_role_stop() skips cleanup because state is still INACTIVE. +This violates the DRD controller design specification (Figure22), +which requires returning to idle state before switching roles. + +This leads to a synchronous external abort in xhci_gen_setup() when +setting up the host controller: + +[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 +[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget +[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed +... +[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller +[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP +[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 +[ 1301.393391] backtrace: + ... + xhci_gen_setup+0xa4/0x408 <-- CRASH + xhci_plat_setup+0x44/0x58 + usb_add_hcd+0x284/0x678 + ... + cdns_role_set+0x9c/0xbc <-- Role switch + +Fix by calling cdns_drd_gadget_off() in the error path to properly +clean up the DRD gadget state. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -3432,6 +3432,7 @@ static int __cdns3_gadget_init(struct cd + ret = cdns3_gadget_start(cdns); + if (ret) { + pm_runtime_put_sync(cdns->dev); ++ cdns_drd_gadget_off(cdns); + return ret; + } + diff --git a/queue-6.12/usb-core-phy-avoid-double-use-of-usb3-phy.patch b/queue-6.12/usb-core-phy-avoid-double-use-of-usb3-phy.patch new file mode 100644 index 0000000000..b0522fbeeb --- /dev/null +++ b/queue-6.12/usb-core-phy-avoid-double-use-of-usb3-phy.patch @@ -0,0 +1,70 @@ +From 0179c6da0793ae03607002c284b53b6d584172d0 Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Mon, 30 Mar 2026 17:02:42 +0200 +Subject: usb: core: phy: avoid double use of 'usb3-phy' + +From: Gabor Juhos + +commit 0179c6da0793ae03607002c284b53b6d584172d0 upstream. + +Commit 53a2d95df836 ("usb: core: add phy notify connect and disconnect") +causes double use of the 'usb3-phy' in certain cases. + +Since that commit, if a generic PHY named 'usb3-phy' is specified in +the device tree, that is getting added to the 'phy_roothub' list of the +secondary HCD by the usb_phy_roothub_alloc_usb3_phy() function. However, +that PHY is getting added also to the primary HCD's 'phy_roothub' list +by usb_phy_roothub_alloc() if there is no generic PHY specified with +'usb2-phy' name. + +This causes that the usb_add_hcd() function executes each phy operations +twice on the 'usb3-phy'. Once when the primary HCD is added, then once +again when the secondary HCD is added. + +The issue affects the Marvell Armada 3700 platform at least, where a +custom name is used for the USB2 PHY: + + $ git grep 'phy-names.*usb3' arch/arm64/boot/dts/marvell/armada-37xx.dtsi | tr '\t' ' ' + arch/arm64/boot/dts/marvell/armada-37xx.dtsi: phy-names = "usb3-phy", "usb2-utmi-otg-phy"; + +Extend the usb_phy_roothub_alloc_usb3_phy() function to skip adding the +'usb3-phy' to the 'phy_roothub' list of the secondary HCD when 'usb2-phy' +is not specified in the device tree to avoid the double use. + +Fixes: 53a2d95df836 ("usb: core: add phy notify connect and disconnect") +Cc: stable +Signed-off-by: Gabor Juhos +Link: https://patch.msgid.link/20260330-usb-avoid-usb3-phy-double-use-v1-1-d2113aecb535@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/phy.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/phy.c ++++ b/drivers/usb/core/phy.c +@@ -114,7 +114,7 @@ EXPORT_SYMBOL_GPL(usb_phy_roothub_alloc) + struct usb_phy_roothub *usb_phy_roothub_alloc_usb3_phy(struct device *dev) + { + struct usb_phy_roothub *phy_roothub; +- int num_phys; ++ int num_phys, usb2_phy_index; + + if (!IS_ENABLED(CONFIG_GENERIC_PHY)) + return NULL; +@@ -124,6 +124,16 @@ struct usb_phy_roothub *usb_phy_roothub_ + if (num_phys <= 0) + return NULL; + ++ /* ++ * If 'usb2-phy' is not present, usb_phy_roothub_alloc() added ++ * all PHYs to the primary HCD's phy_roothub already, so skip ++ * adding 'usb3-phy' here to avoid double use of that. ++ */ ++ usb2_phy_index = of_property_match_string(dev->of_node, "phy-names", ++ "usb2-phy"); ++ if (usb2_phy_index < 0) ++ return NULL; ++ + phy_roothub = devm_kzalloc(dev, sizeof(*phy_roothub), GFP_KERNEL); + if (!phy_roothub) + return ERR_PTR(-ENOMEM); diff --git a/queue-6.12/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch b/queue-6.12/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch new file mode 100644 index 0000000000..2c07c1f64b --- /dev/null +++ b/queue-6.12/usb-dwc2-gadget-fix-spin_lock-unlock-mismatch-in-dwc2_hsotg_udc_stop.patch @@ -0,0 +1,45 @@ +From 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a Mon Sep 17 00:00:00 2001 +From: Juno Choi +Date: Tue, 24 Mar 2026 10:49:10 +0900 +Subject: usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() + +From: Juno Choi + +commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a upstream. + +dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, +which expects hsotg->lock to be held since it does spin_unlock/spin_lock +around the gadget driver callback invocation. + +However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() +without holding the lock. This leads to: + - spin_unlock on a lock that is not held (undefined behavior) + - The lock remaining held after dwc2_gadget_exit_clock_gating() returns, + causing a deadlock when spin_lock_irqsave() is called later in the + same function. + +Fix this by acquiring hsotg->lock before calling +dwc2_gadget_exit_clock_gating() and releasing it afterwards, which +satisfies the locking requirement of the call_gadget() macro. + +Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended") +Cc: stable +Signed-off-by: Juno Choi +Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4607,7 +4607,9 @@ static int dwc2_hsotg_udc_stop(struct us + /* Exit clock gating when driver is stopped. */ + if (hsotg->params.power_down == DWC2_POWER_DOWN_PARAM_NONE && + hsotg->bus_suspended && !hsotg->params.no_clock_gating) { ++ spin_lock_irqsave(&hsotg->lock, flags); + dwc2_gadget_exit_clock_gating(hsotg, 0); ++ spin_unlock_irqrestore(&hsotg->lock, flags); + } + + /* all endpoints should be shutdown */ diff --git a/queue-6.12/usb-ehci-brcm-fix-sleep-during-atomic.patch b/queue-6.12/usb-ehci-brcm-fix-sleep-during-atomic.patch new file mode 100644 index 0000000000..4fc670db96 --- /dev/null +++ b/queue-6.12/usb-ehci-brcm-fix-sleep-during-atomic.patch @@ -0,0 +1,37 @@ +From 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 18 Mar 2026 11:57:07 -0700 +Subject: usb: ehci-brcm: fix sleep during atomic + +From: Justin Chen + +commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream. + +echi_brcm_wait_for_sof() gets called after disabling interrupts +in ehci_brcm_hub_control(). Use the atomic version of poll_timeout +to fix the warning. + +Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's") +Cc: stable +Signed-off-by: Justin Chen +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ehci-brcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-brcm.c ++++ b/drivers/usb/host/ehci-brcm.c +@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so + int res; + + /* Wait for next microframe (every 125 usecs) */ +- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val, +- val != frame_idx, 1, 130); ++ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index, ++ val, val != frame_idx, 1, 130); + if (res) + ehci_err(ehci, "Error waiting for SOF\n"); + udelay(delay); diff --git a/queue-6.12/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch b/queue-6.12/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch new file mode 100644 index 0000000000..3616bfecd1 --- /dev/null +++ b/queue-6.12/usb-quirks-add-delay_init-quirk-for-another-silicon-motion-flash-drive.patch @@ -0,0 +1,31 @@ +From dd36014ec6042f424ef51b923e607772f7502ee7 Mon Sep 17 00:00:00 2001 +From: Miao Li +Date: Thu, 19 Mar 2026 13:39:27 +0800 +Subject: usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive + +From: Miao Li + +commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream. + +Another Silicon Motion flash drive also randomly work incorrectly +(lsusb does not list the device) on Huawei hisi platforms during +500 reboot cycles, and the DELAY_INIT quirk fixes this issue. + +Signed-off-by: Miao Li +Cc: stable +Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -402,6 +402,7 @@ static const struct usb_device_id usb_qu + + /* Silicon Motion Flash Drive */ + { USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Sound Devices USBPre2 */ + { USB_DEVICE(0x0926, 0x0202), .driver_info = diff --git a/queue-6.12/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch b/queue-6.12/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch new file mode 100644 index 0000000000..ff0d3e8dc7 --- /dev/null +++ b/queue-6.12/usb-ulpi-fix-double-free-in-ulpi_register_interface-error-path.patch @@ -0,0 +1,46 @@ +From 01af542392b5d41fd659d487015a71f627accce3 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Wed, 1 Apr 2026 10:51:42 +0800 +Subject: usb: ulpi: fix double free in ulpi_register_interface() error path + +From: Guangshuo Li + +commit 01af542392b5d41fd659d487015a71f627accce3 upstream. + +When device_register() fails, ulpi_register() calls put_device() on +ulpi->dev. + +The device release callback ulpi_dev_release() drops the OF node +reference and frees ulpi, but the current error path in +ulpi_register_interface() then calls kfree(ulpi) again, causing a +double free. + +Let put_device() handle the cleanup through ulpi_dev_release() and +avoid freeing ulpi again in ulpi_register_interface(). + +Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") +Cc: stable +Signed-off-by: Guangshuo Li +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/ulpi.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(str + ulpi->ops = ops; + + ret = ulpi_register(dev, ulpi); +- if (ret) { +- kfree(ulpi); ++ if (ret) + return ERR_PTR(ret); +- } ++ + + return ulpi; + } diff --git a/queue-6.12/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch b/queue-6.12/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch new file mode 100644 index 0000000000..681c842a95 --- /dev/null +++ b/queue-6.12/usb-usbtmc-flush-anchored-urbs-in-usbtmc_release.patch @@ -0,0 +1,37 @@ +From 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Mon Sep 17 00:00:00 2001 +From: Heitor Alves de Siqueira +Date: Thu, 12 Mar 2026 09:27:28 -0300 +Subject: usb: usbtmc: Flush anchored URBs in usbtmc_release + +From: Heitor Alves de Siqueira + +commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream. + +When calling usbtmc_release, pending anchored URBs must be flushed or +killed to prevent use-after-free errors (e.g. in the HCD giveback +path). Call usbtmc_draw_down() to allow anchored URBs to be completed. + +Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file") +Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f +Cc: stable +Signed-off-by: Heitor Alves de Siqueira +Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode * + list_del(&file_data->file_elem); + + spin_unlock_irq(&file_data->data->dev_lock); ++ ++ /* flush anchored URBs */ ++ usbtmc_draw_down(file_data); + mutex_unlock(&file_data->data->io_mutex); + + kref_put(&file_data->data->kref, usbtmc_delete);