summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-03-11usb: renesas_usbhs: fix use-after-free in ISR during device removalFan Wu1-0/+9
In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free. Fix this by calling devm_free_irq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhs_pipe_remove() is called. Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") Cc: stable <stable@kernel.org> Suggested-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260303073344.34577-1-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: cdc-acm: Restore CAP_BRK functionnality to CH343Marc Zyngier2-0/+6
The CH343 USB/serial adapter is as buggy as it is popular (very). One of its quirks is that despite being capable of signalling a BREAK condition, it doesn't advertise it. This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break") applied some reasonable restrictions, preventing breaks from being emitted on devices that do not advertise CAP_BRK. Add a quirk for this particular device, so that breaks can still be produced on some of my machines attached to my console server. Fixes: 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break") Signed-off-by: Marc Zyngier <maz@kernel.org> Cc: stable <stable@kernel.org> Cc: Oliver Neukum <oneukum@suse.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20260301124440.1192752-1-maz@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: gadget: f_mass_storage: Fix potential integer overflow in ↵Seungjin Bae1-2/+10
check_command_size_in_blocks() The `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows. Fixes: 144974e7f9e3 ("usb: gadget: mass_storage: support multi-luns with different logic block size") Signed-off-by: Seungjin Bae <eeodqql09@gmail.com> Reviewed-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/20260228104324.1696455-2-eeodqql09@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: gadget: f_hid: fix SuperSpeed descriptorsJohn Keeping1-0/+4
When adding dynamic configuration for bInterval, the value was removed from the static SuperSpeed endpoint descriptors but was not set from the configured value in hidg_bind(). Thus at SuperSpeed the interrupt endpoints have bInterval as zero which is not valid per the USB specification. Add the missing setting for SuperSpeed endpoints. Fixes: ea34925f5b2ee ("usb: gadget: hid: allow dynamic interval configuration via configfs") Cc: stable <stable@kernel.org> Signed-off-by: John Keeping <jkeeping@inmusicbrands.com> Acked-by: Peter Korsgaard <peter@korsgaard.com> Link: https://patch.msgid.link/20260227111540.431521-1-jkeeping@inmusicbrands.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: core: new quirk to handle devices with zero configurationsJie Deng2-1/+10
Some USB devices incorrectly report bNumConfigurations as 0 in their device descriptor, which causes the USB core to reject them during enumeration. logs: usb 1-2: device descriptor read/64, error -71 usb 1-2: no configurations usb 1-2: can't read configurations, error -22 However, these devices actually work correctly when treated as having a single configuration. Add a new quirk USB_QUIRK_FORCE_ONE_CONFIG to handle such devices. When this quirk is set, assume the device has 1 configuration instead of failing with -EINVAL. This quirk is applied to the device with VID:PID 5131:2007 which exhibits this behavior. Signed-off-by: Jie Deng <dengjie03@kylinos.cn> Link: https://patch.msgid.link/20260227084931.1527461-1-dengjie03@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: misc: uss720: properly clean up reference in uss720_probe()Greg Kroah-Hartman1-1/+1
If get_1284_register() fails, the usb device reference count is incorrect and needs to be properly dropped before returning. That will happen when the kref is dropped in the call to destroy_priv(), so jump to that error path instead of returning directly. Cc: stable <stable@kernel.org> Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026022342-smokiness-stove-d792@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: core: Limit the length of unkillable synchronous timeoutsAlan Stern1-14/+13
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeoutsAlan Stern1-3/+3
The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usb_bulk_msg() calls. Since the user can specify arbitrarily long timeouts and usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable() instead to avoid the possibility of the user hanging a kernel thread indefinitely. Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout") CC: stable@vger.kernel.org Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: usbcore: Introduce usb_bulk_msg_killable()Alan Stern1-10/+69
The synchronous message API in usbcore (usb_control_msg(), usb_bulk_msg(), and so on) uses uninterruptible waits. However, drivers may call these routines in the context of a user thread, which means it ought to be possible to at least kill them. For this reason, introduce a new usb_bulk_msg_killable() function which behaves the same as usb_bulk_msg() except for using wait_for_completion_killable_timeout() instead of wait_for_completion_timeout(). The same can be done later for usb_control_msg() later on, if it turns out to be needed. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Suggested-by: Oliver Neukum <oneukum@suse.com> Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Link: https://patch.msgid.link/248628b4-cc83-4e81-a620-3ce4e0376d41@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: core: don't power off roothub PHYs if phy_set_mode() failsGabor Juhos1-7/+1
Remove the error path from the usb_phy_roothub_set_mode() function. The code is clearly wrong, because phy_set_mode() calls can't be balanced with phy_power_off() calls. Additionally, the usb_phy_roothub_set_mode() function is called only from usb_add_hcd() before it powers on the PHYs, so powering off those makes no sense anyway. Presumably, the code is copy-pasted from the phy_power_on() function without adjusting the error handling. Cc: stable@vger.kernel.org # v5.1+ Fixes: b97a31348379 ("usb: core: comply to PHY framework") Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://patch.msgid.link/20260218-usb-phy-poweroff-fix-v1-1-66e6831e860e@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11drm/amd/display: Add documentation and cleanup DMUB HW lock managerNicholas Kazlauskas1-0/+18
To document how the helpers should be used before a subsequent change adds new locations that these helpers will be used. Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com> Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Add new types to replay configChunTao Tso3-1/+4
[WHAT] Add FRAME_SKIPPING_ERROR_STATUS to dpcd_replay_configuration. Add received_frame_skipping_error_hpd to replay_config. Add REPLAY_GENERAL_CMD_SET_COASTING_VTOTAL_WITHOUT_FRAME_UPDATE to dmub_cmd_replay_general_subtype. Reviewed-by: Aric Cyr <aric.cyr@amd.com> Signed-off-by: ChunTao Tso <chuntao.tso@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Fix HWSS v3 fast path determinationNicholas Kazlauskas1-20/+18
[WHY] We're checking surface and stream updates after they've been applied to their respective states within `update_planes_and_stream_state`. Medium updates under the HWSS V3 fast path that are not supported or tested are getting implicitly if they don't trigger a DML validation and getting updated in place on the dc->current_state context. [HOW] Fix this issue by moving up the fast path determination check prior to `update_planes_and_stream_state`. This is how the V2 path works and how the V3 path used to work prior to the refactors in this area. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Add missing DCCG register entries for DCN20-DCN316Ivan Lipski4-4/+20
Commit 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") moved register writes from hwseq to dccg2_*() functions but did not add the registers to the DCCG register list macros. The struct fields default to 0, so REG_WRITE() targets MMIO offset 0, causing a GPU hang on resume (seen on DCN21/DCN30 during IGT kms_cursor_crc@cursor-suspend). Add - MICROSECOND_TIME_BASE_DIV - MILLISECOND_TIME_BASE_DIV - DCCG_GATE_DISABLE_CNTL - DCCG_GATE_DISABLE_CNTL2 - DC_MEM_GLOBAL_PWR_REQ_CNTL to macros in dcn20_dccg.h, dcn301_dccg.h, dcn31_dccg.h, and dcn314_dccg.h. Fixes: 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") Reported-by: Rafael Passos <rafael@rcpassos.me> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Add ESD detection for replay recoveryWeiguang Li2-11/+28
[HOW] Add Replay recovery flow so that when HPD occurs and ESD is detected, Replay can restore the system back to normal. Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Reviewed-by: Robin Chen <robin.chen@amd.com> Reviewed-by: Aric Cyr <aric.cyr@amd.com> Signed-off-by: Weiguang Li <wei-guang.li@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Update underflow detectionCharlene Liu2-2/+6
[WHY] Add underflow detection for later ASICs. Reviewed-by: Leo Chen <leo.chen@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Add COLOR_ENCODING/COLOR_RANGE to overlay planesHarry Wentland1-1/+2
Extend COLOR_ENCODING and COLOR_RANGE property creation to overlay planes in addition to primary planes. This allows overlay planes to use YUV formats with proper color space configuration when the hardware supports NV12/P010 formats. These properties control the YUV-to-RGB conversion matrix selection (BT.601/BT.709/BT.2020) and range handling (limited/full range). Assisted-by: Claude: claude-sonnet-4.5 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Add NV12/P010 formats to primary planeHarry Wentland1-0/+3
Add NV12, NV21, and P010 YUV formats to the primary plane's supported format list, enabling YUV content to be scanned out directly from the primary plane. Assisted-by: Claude: claude-sonnet-4.5 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Set chroma taps to 1 if luma taps are 1Harry Wentland2-4/+12
When luma is unscaled we also want chroma to be pixel-perfect. When luma taps are > 1 the result will be a blurred luma plane, even when the image isn't scaled. This makes IGT tests for CSC colorop pass. Assisted-by: Claude: claude-sonnet-4.5 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Add min clock init for DML21 mode programmingOvidiu Bunea3-0/+27
[WHY & HOW] 0 stream cases do not go through any DML validation which leaves DCN clocks in unoptimized states. If requesting DML validation or programming with 0 streams, program DCN clocks to lowest DPM state. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Return early from vesa replay enable functionPeichen Huang1-11/+12
[WHY & HOW] If the enable state is already as expect then just return. Reviewed-by: Robin Chen <robin.chen@amd.com> Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Peichen Huang <PeiChen.Huang@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11drm/amd/display: Clean up NULL pointer warnings in dml2Gaghik Khachatrian1-3/+38
This commit addresses multiple warnings by adding defensive checks for NULL pointers before dereferencing them. The changes ensure that pointers such as are validated, preventing potential undefined behavior. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-11usb: typec: tcpm: add support for Sink Cap Extended msg responseAmit Sunil Dhamne1-1/+252
Add support for responding to Sink Cap Extended msg request. To achieve this, include parsing support for DT properties related to Sink Cap Extended. The request for Sink Cap Ext is a control message while the response is an extended message (chunked). As the Sink Caps Extended Data Block size (24 Byte) is less than MaxExtendedMsgChunkLen (26 Byte), a single chunk is sufficient to complete this AMS. Supporting sink cap extended messages while responding to a Get_Sink_Caps_Extended request when port is in Sink role is required in order to be compliant with at least USB PD Rev3.1 Ver1.8. Signed-off-by: Amit Sunil Dhamne <amitsd@google.com> Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260223-skedb-v2-2-60675765bc7e@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: endpoint: drop custom sysfs attribute structureThomas Weißschuh1-8/+0
Nowadays the USB endpoints use device attributes, so the custom structure is unused. Drop it. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Link: https://patch.msgid.link/20260223-sysfs-const-usb-v1-1-54c4434d83c8@weissschuh.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: typec: tcpm: Add vid and chip info for Etek ET7304Yuanshen Cao1-1/+15
Move VID field to chip info to accommodate different VIDs. Add chip info for Etek Micro ET7304. ET7304 is functionally identical to the Richtek RT1715, with the only difference being the VID. Signed-off-by: Yuanshen Cao <alex.caoys@gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260220-et7304-v3-2-ede2d9634957@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usbip: vhci_sysfs: Use safer strscpy() instead of strcpy()Ai Chao1-1/+1
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-7-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: gadget: udc: Use safer strscpy() instead of strcpy()Ai Chao1-1/+1
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-6-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: typec: tcpm: Use safer strscpy() instead of strcpy()Ai Chao1-3/+3
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-5-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: gadget: functionfs: Use safer strscpy() instead of strcpy()Ai Chao2-4/+4
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-4-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: musb: Use safer strscpy() instead of strcpy()Ai Chao1-1/+1
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-3-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: serial: ti_usb_3410_5052: Use safer strscpy() instead of strcpy()Ai Chao1-8/+8
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-2-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: typec: mux: avoid duplicated mux switchesSebastian Reichel1-1/+12
Some devices use combo PHYs (i.e. USB3 + DisplayPort), which also handle the lane muxing. These PHYs are referenced twice from the USB-C connector (USB super-speed lines and SBU/AUX lines) resulting in the mux being configured twice. Avoid this by dropping duplicates. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260223-typec-mux-duplication-fix-v2-2-0402fefc222e@collabora.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: typec: mux: avoid duplicated orientation switchesSebastian Reichel1-1/+11
Some devices use combo PHYs (i.e. USB3 + DisplayPort), which also handle the orientation mux. These PHYs are referenced twice from the USB-C connector (USB super-speed lines and SBU/AUX lines) resulting in the switch being configured twice. Avoid this by dropping duplicates. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260223-typec-mux-duplication-fix-v2-1-0402fefc222e@collabora.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: typec: Fix error pointer dereferenceEthan Tidmore1-2/+4
The variable tps->partner is checked for an error pointer and then if it is, it sends an error message but does not return and then immediately dereferenced a few lines below: tps->partner = typec_register_partner(tps->port, &desc); if (IS_ERR(tps->partner)) dev_warn(tps->dev, "%s: failed to register partnet\n", __func__); if (desc.identity) { typec_partner_set_identity(tps->partner); cd321x->cur_partner_identity = st.partner_identity; } Add early return and fix spelling mistake in error message. Detected by Smatch: drivers/usb/typec/tipd/core.c:827 cd321x_update_work() error: 'tps->partner' dereferencing possible ERR_PTR() Fixes: 82432bbfb9e83 ("usb: typec: tipd: Handle mode transitions for CD321x") Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260218214621.38154-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: typec: tcpci: Make tcpci_pm_ops variable staticKrzysztof Kozlowski1-1/+1
File-scope 'tcpci_pm_ops' is not used outside of this unit, so make it static to silence sparse warning: tcpm/tcpci.c:1002:1: warning: symbol 'tcpci_pm_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> Link: https://patch.msgid.link/20260216110403.159945-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: typec: ucsi: Invoke ucsi_run_command tracepointLoic Poulain1-0/+2
The ucsi_run_command trace event is exposed in tracefs, but it never produces any output because the UCSI core never invokes the associated tracepoint. As a result, enabling the event under events/ucsi/ yields no traces, preventing users from inspecting UCSI command sequencing. Wire the tracepoint into the UCSI command path so that commands are properly reported. Example: 50.692342: ucsi_run_command: GET_CONNECTOR_STATUS -> OK (err=0) 50.692345: ucsi_connector_change: port0 status: change=4800, ... 51.750298: ucsi_run_command: GET_CABLE_PROPERTY -> FAIL (err=-5) 51.773360: ucsi_run_command: GET_CONNECTOR_STATUS -> OK (err=0) Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260217103403.1956-1-loic.poulain@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreensHans de Goede1-3/+11
Elan touchscreens have a HID-battery device for the stylus which is always there even if there is no stylus. This is causing upower to report an empty battery for the stylus and some desktop-environments will show a notification about this, which is quite annoying. Because of this the HID-battery is being ignored on all Elan I2c and USB touchscreens, but this causes there to be no battery reporting for the stylus at all. This adds a new HID_BATTERY_QUIRK_DYNAMIC and uses these for the Elan touchscreens. This new quirks causes the present value of the battery to start at 0, which will make userspace ignore it and only sets present to 1 after receiving a battery input report which only happens when the stylus gets in range. Reported-by: ggrundik@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221118 Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-03-11HID: input: Drop Asus UX550* touchscreen ignore battery quirksHans de Goede2-6/+0
Drop the Asus UX550* touchscreen ignore battery quirks, there is a blanket HID_BATTERY_QUIRK_IGNORE for all USB_VENDOR_ID_ELAN USB touchscreens now, so these are just a duplicate of those. Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-03-11usb: dwc3: gadget: use explicit 0 for success in __dwc3_gadget_kick_transfer()Zeeshan Ahmad1-1/+1
Smatch warns that __dwc3_gadget_kick_transfer() might be missing an error code when returning 'ret' at line 1691. While 'ret' is guaranteed to be 0 at this point, returning an explicit 0 improves readability by removing a level of indirection and clarifies the intent that this is a successful "no-op" path. This change also silences the Smatch warning. Suggested-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Zeeshan Ahmad <zeeshanahmad022019@gmail.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260306090643.47383-1-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: qcom: simplify error check in dwc3_qcom_find_num_ports()Zeeshan Ahmad1-2/+2
The platform_get_irq_byname_optional() function returns a non-zero IRQ number on success and a negative error code on failure. It never returns zero. The current implementation in the modern dwc3-qcom driver checks for a return value less than or equal to zero. Since zero is not a valid return value, simplify the check to only look for negative error codes. This aligns the logic with the standard return contract of the platform IRQ APIs. Signed-off-by: Zeeshan Ahmad <zeeshanahmad022019@gmail.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260225065157.8952-1-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11random: vDSO: Remove ifdefferyThomas Weißschuh1-8/+6
Recent cleanups of the vDSO headers allow the unconditional inclusion of vdso/datapage.h and the declarations it provides. This also means that the declaration of vdso_k_rng_data is always visible and its usage does not need to be guarded by ifdefs anymore. Instead use IS_ENABLED(). Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-15-35d60acf7410@linutronix.de
2026-03-11random: vDSO: Trim vDSO includesThomas Weißschuh1-2/+0
These includes are not used, remove them. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-14-35d60acf7410@linutronix.de
2026-03-11USB: usbsevseg: drop redundant device referenceJohan Hovold1-2/+1
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260305111511.18386-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: trancevibrator: drop redundant device referenceJohan Hovold1-2/+1
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260305111511.18386-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: ljca: drop redundant interface referenceJohan Hovold1-10/+5
Driver core holds a reference to the USB interface while it is bound to a driver and there is no need to take another reference unless the interface is needed after disconnect. Drop the redundant interface reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/20260305111511.18386-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: cytherm: drop redundant device referenceJohan Hovold1-3/+1
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260305111511.18386-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11USB: cypress_cy7c63: drop redundant device referenceJohan Hovold1-3/+1
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260305111511.18386-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: image: microtek: use dev_warn and dev_errOliver Neukum1-18/+12
Do not use useless private macros Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20260305102905.2392512-5-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: image: microtek: remove unused macroOliver Neukum1-2/+0
No users left. Remove it. Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20260305102905.2392512-4-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: image: microtek: remove outdated commentOliver Neukum1-1/+0
The comment is no longer true Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20260305102905.2392512-3-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>