kernel/linux.git/drivers/usb, branch master

Merge tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2026-04-19T15:47:40+00:00

Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 7.1-rc1. Lots of little things in here, nothing major, just constant improvements, updates, and new features. Highlights are: - new USB power supply driver support. These changes did touch outside of drivers/usb/ but got acks from the relevant mantainers for them. - dts file updates and conversions - string function conversions into "safer" ones - new device quirks - xhci driver updates - usb gadget driver minor fixes - typec driver additions and updates - small number of thunderbolt driver changes - dwc3 driver updates and additions of new hardware support - other minor driver updates All of these have been in the linux-next tree for a while with no reported issues" * tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (176 commits) usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controller dt-bindings: usb: dwc3: add support for StarFive JHB100 dt-bindings: usb: atmel,at91sam9rl-udc: convert to DT schema dt-bindings: usb: atmel,at91rm9200-udc: convert to DT schema dt-bindings: usb: generic-ehci: fix schema structure and add at91sam9g45 constraints dt-bindings: usb: generic-ohci: add AT91RM9200 OHCI binding support arm: dts: at91: remove unused #address-cells/#size-cells from sam9x60 udc node drivers/usb/host: Fix spelling error 'seperate' -> 'separate' usbip: tools: add hint when no exported devices are found USB: serial: iuu_phoenix: fix iuutool author name usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() usb: gadget: f_hid: Add missing error code usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions dt-bindings: chrome: Add cros-ec-ucsi compatibility to typec binding USB: of: Simplify with scoped for each OF child loop usbip: validate number_of_packets in usbip_pack_ret_submit() usb: gadget: renesas_usb3: validate endpoint index in standard request handlers usb: core: config: reverse the size check of the SSP isoc endpoint descriptor usb: typec: ucsi: Set usb mode on partner change ...

usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controller

2026-04-11T10:02:43+00:00

JHB100 contains 2 dwc3 USB controllers and PHYs and working as USB 2.0 speed. It can working in generic platform and setting default properties. Signed-off-by: Minda Chen Link: https://patch.msgid.link/20260410112500.90432-3-minda.chen@starfivetech.com Signed-off-by: Greg Kroah-Hartman

drivers/usb/host: Fix spelling error 'seperate' -> 'separate'

2026-04-11T10:02:11+00:00

Fix typo in comment where 'seperate' should be 'separate'. Signed-off-by: Qinghua Zhao Link: https://patch.msgid.link/20260409145428.18130-1-zqh1630@126.com Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-serial-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next

2026-04-11T09:58:41+00:00

Johan writes: USB serial updates for 7.1-rc1 Here are the USB serial updates for 7.1-rc1, including: - use strscpy() instead of strcpy() - new modem device id All have been in linux-next with no reported issues. * tag 'usb-serial-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: iuu_phoenix: fix iuutool author name USB: serial: option: add Telit Cinterion FN990A MBIM composition USB: serial: ti_usb_3410_5052: use strscpy() instead of strcpy()

USB: serial: iuu_phoenix: fix iuutool author name

2026-04-08T07:37:43+00:00

The original iuutool author is Juan Carlos Borrás - fix the spelling. Signed-off-by: Thorsten Blum Signed-off-by: Johan Hovold

usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

2026-04-07T11:50:49+00:00

The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of: ndp_index > (block_len - opts->ndp_size) will underflow producing a huge unsigned value that ndp_index can never exceed, defeating the check entirely. The same underflow occurs in the datagram index checks against block_len - opts->dpe_size. With those checks neutered, a malicious USB host can choose ndp_index and datagram offsets that point past the actual transfer, and the skb_put_data() copies adjacent kernel memory into the network skb. Fix this by rejecting block lengths that cannot hold at least the NTB header plus one NDP. This will make block_len - opts->ndp_size and block_len - opts->dpe_size both well-defined. Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed a related class of issues on the host side of NCM. Fixes: 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()") Cc: stable Assisted-by: gregkh_clanker_t1000 Link: https://patch.msgid.link/2026040753-baffle-handheld-624d@gregkh Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()

2026-04-07T11:50:34+00:00

A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers. pn_rx_complete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGE_SIZE by the gadget. If the host always sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be reset and each completion will add another fragment via skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17), subsequent frag stores overwrite memory adjacent to the shinfo on the heap. Drop the skb and account a length error when the frag limit is reached, matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path"). Cc: stable Assisted-by: gregkh_clanker_t1000 Link: https://patch.msgid.link/2026040705-fruit-unloved-0701@gregkh Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_hid: Add missing error code

2026-04-07T11:50:14+00:00

Currently in cdev_alloc() error path no error code is assigned. Assign error code '-ENOMEM'. Detected by Smatch: drivers/usb/gadget/function/f_hid.c:1291 hidg_bind() warn: missing error code 'status' Fixes: 81ebd43cc0d6d ("usb: gadget: f_hid: don't call cdev_init while cdev in use") Signed-off-by: Ethan Tidmore Acked-by: Peter Korsgaard Reviewed-by: Michael Zimmermann Link: https://patch.msgid.link/20260402180008.64233-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions

2026-04-07T11:49:53+00:00

Add support for cros_ec_ucsi to load based on "google,cros-ec-ucsi" compatible devices and "GOOG0021" ACPI nodes. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Reviewed-by: Abhishek Pandit-Subedi Link: https://patch.msgid.link/20260403223357.1896403-3-jthies@google.com Signed-off-by: Greg Kroah-Hartman

USB: of: Simplify with scoped for each OF child loop

2026-04-07T11:49:48+00:00

Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Hans Zhang <18255117159@163.com> Link: https://patch.msgid.link/20260407013122.1296818-1-18255117159@163.com Signed-off-by: Greg Kroah-Hartman