* Re: [PATCH v2] usbip: vudc: fix NULL deref in vep_dequeue()
From: Greg Kroah-Hartman @ 2026-06-25 15:12 UTC (permalink / raw)
To: me
Cc: Valentina Manea, Shuah Khan, Hongren Zheng, Krzysztof Opasiak,
Igor Kotrasinski, Karol Kosik, linux-usb, linux-kernel
In-Reply-To: <20260620-usbip-vudc-deque-fix-v2-1-d1913ab4611b@samcday.com>
On Sat, Jun 20, 2026 at 10:18:09AM +1000, Sam Day via B4 Relay wrote:
> From: Sam Day <me@samcday.com>
>
> vep_alloc_request() wasn't initializing vrequest->udc, so cancellations
> on the FunctionFS AIO path were arriving in vep_dequeue without a valid
> UDC reference.
>
> Since vrequest->udc is never actually properly used anywhere, we opt to
> remove it, and update vep_dequeue to obtain a reference to the udc with
> ep_to_vudc(), consistent with the other vep_ ops.
>
> AFAICT this bug has existed for ~10 years. Seems that nobody has really
> stressed the FunctionFS AIO path on usbip's vudc.
>
> I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints
> via AIO. Before the fix, running `usbip attach` from the host would
> cause the guest to oops with the following backtrace:
>
> Call trace:
> vep_dequeue+0x1c/0xe4 (P)
> usb_ep_dequeue+0x14/0x20
> ffs_aio_cancel+0x24/0x34
> __arm64_sys_io_cancel+0xb0/0x124
> do_el0_svc+0x68/0x100
> el0_svc+0x18/0x5c
> el0t_64_sync_handler+0x98/0xdc
> el0t_64_sync+0x154/0x158
>
> Assisted-by: opencode:openai/gpt-5.5
> Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops")
> Signed-off-by: Sam Day <me@samcday.com>
> ---
> Changes in v2:
> - Reworked to remove vrequest->udc entirely and a call to ep_to_vudc()
> from vep_deqe
> - Link to v1: https://lore.kernel.org/r/20260619-usbip-vudc-deque-fix-v1-1-9021463b1903@samcday.com
> ---
> drivers/usb/usbip/vudc.h | 1 -
> drivers/usb/usbip/vudc_dev.c | 2 +-
> 2 files changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/usb/usbip/vudc.h b/drivers/usb/usbip/vudc.h
> index faf61c9c6a98..5ef0e7d9b23a 100644
> --- a/drivers/usb/usbip/vudc.h
> +++ b/drivers/usb/usbip/vudc.h
> @@ -38,7 +38,6 @@ struct vep {
>
> struct vrequest {
> struct usb_request req;
> - struct vudc *udc;
> struct list_head req_entry; /* Request queue */
> };
>
> diff --git a/drivers/usb/usbip/vudc_dev.c b/drivers/usb/usbip/vudc_dev.c
> index c5f079c5a1ea..f0a1a44c18e3 100644
> --- a/drivers/usb/usbip/vudc_dev.c
> +++ b/drivers/usb/usbip/vudc_dev.c
> @@ -344,7 +344,7 @@ static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
>
> ep = to_vep(_ep);
> req = to_vrequest(_req);
> - udc = req->udc;
> + udc = ep_to_vudc(ep);
Why is "req" still needed now? Shouldn't that variable be removed also?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] usbip: tools: support SuperSpeed Plus devices
From: Greg KH @ 2026-06-25 15:09 UTC (permalink / raw)
To: raoxu; +Cc: valentina.manea.m, shuah, i, linux-usb, linux-kernel
In-Reply-To: <1B3C4D10DA532DC9+20260622100802.377751-1-raoxu@uniontech.com>
On Mon, Jun 22, 2026 at 06:08:02PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
>
> USB/IP reads a remote device's speed from the server-side sysfs
> "speed" attribute. read_attr_speed() converts the string to
> enum usb_device_speed before the value is sent to the client.
>
> The conversion table only recognizes 5000 Mbps. Devices reporting
> 10000 or 20000 Mbps are therefore sent as USB_SPEED_UNKNOWN. The
> client then selects a USB 2.0 VHCI port, and the kernel rejects the
> attach request because USB_SPEED_UNKNOWN is not a supported speed.
>
> Map both SuperSpeed Plus sysfs values to USB_SPEED_SUPER_PLUS and
> select the SuperSpeed VHCI hub for that speed.
>
> The issue was reproduced with the following server hardware:
>
> xHCI controller: Intel 8086:a0ed, revision 20
> Subsystem: Lenovo 17aa:382a
> USB device: Silicon Motion 090c:2320 mass storage
> sysfs speed: 10000 Mbps
>
> Before the change:
>
> $ usbip attach -r 10.20.12.170 -b 2-2
> usbip: error: import device
>
> After the change, the device attaches and uses usb-storage:
>
> $ usbip port
> Port 08: <Port in Use> at Super Speed(5000Mbps)
> 8-1 -> usbip://10.20.12.170:3240/2-2
>
> VHCI currently exposes the imported device as SuperSpeed, so the
> client reports 5000 Mbps instead of 10000 Mbps. This is a separate
> speed-reporting limitation and does not prevent attachment or I/O.
>
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> ---
> tools/usb/usbip/libsrc/usbip_common.c | 2 ++
> tools/usb/usbip/libsrc/vhci_driver.c | 1 +
> 2 files changed, 3 insertions(+)
Isn't this covered by this change:
https://lore.kernel.org/r/00C828F338E43447+20260617020613.199086-1-chenyichong@uniontech.com
?
thanks,
greg k-h
^ permalink raw reply
* [PATCH] MAINTAINERS: USB: add rust.rs to USB subsystem file list
From: Greg Kroah-Hartman @ 2026-06-25 15:08 UTC (permalink / raw)
To: linux-usb, rust-for-linux
Cc: linux-kernel, Greg Kroah-Hartman, Danilo Krummrich
As was recently noted on the rust-for-linux list, the usb.rs file is not
listed as part of the USB SUBSYSTEM files, which can cause changes to it
to be not sent to the proper list and people. Fix this up by adding it
to the USB SUBSYSTEM file list
Reported-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
MAINTAINERS | 1 +
1 file changed, 1 insertion(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 3eeb134cb611..f477e348ecc0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -28054,6 +28054,7 @@ F: include/dt-bindings/usb/
F: include/linux/usb.h
F: include/linux/usb/
F: include/uapi/linux/usb/
+F: rust/kernel/usb.rs
USB TYPEC BUS FOR ALTERNATE MODES
M: Heikki Krogerus <heikki.krogerus@linux.intel.com>
--
2.54.0
^ permalink raw reply related
* Re: [PATCH] USB: serial: digi_acceleport: fix hard lockup on disconnect
From: Greg Kroah-Hartman @ 2026-06-25 14:56 UTC (permalink / raw)
To: Johan Hovold; +Cc: linux-usb, linux-kernel, stable
In-Reply-To: <20260623151110.315126-1-johan@kernel.org>
On Tue, Jun 23, 2026 at 05:11:10PM +0200, Johan Hovold wrote:
> If submitting the OOB write urb fails persistently (e.g if the device is
> being disconnected) the driver would loop indefinitely with interrupts
> disabled.
>
> Check for urb submission errors when sending OOB commands to avoid
> hanging if, for example, open(), set_termios() or close() races with a
> physical disconnect.
>
> This is issue was flagged by Sashiko when reviewing an unrelated change
> to the driver.
>
> Link: https://sashiko.dev/#/patchset/20260610132232.356139-1-johan%40kernel.org?part=1
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH] USB: serial: digi_acceleport: fix write buffer corruption
From: Greg Kroah-Hartman @ 2026-06-25 14:56 UTC (permalink / raw)
To: Johan Hovold; +Cc: linux-usb, linux-kernel, stable
In-Reply-To: <20260623151229.315224-1-johan@kernel.org>
On Tue, Jun 23, 2026 at 05:12:29PM +0200, Johan Hovold wrote:
> The digi_write_inb_command() is supposed to wait for the write urb to
> become available or return an error, but instead it updates the transfer
> buffer and tries to resubmit the urb on timeout.
>
> To make things worse, for commands like break control where no timeout
> is used, the driver would corrupt the urb immediately due to a broken
> jiffies comparison (on 32-bit machines this takes five minutes of uptime
> to trigger due to INITIAL_JIFFIES).
>
> Fix this by adding the missing return on timeout and waiting
> indefinitely when no timeout has been specified as intended.
>
> This issue was (sort of) flagged by Sashiko when reviewing an unrelated
> change to the driver.
>
> Link: https://sashiko.dev/#/patchset/20260610132232.356139-1-johan%40kernel.org?part=11
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH] usb: gadget: fsl_qe_udc: fix gadget lifetime on registration failure
From: Greg KH @ 2026-06-25 14:55 UTC (permalink / raw)
To: Haoxiang Li
Cc: kees, balbi, sebastian, linux-usb, linuxppc-dev, linux-kernel,
stable
In-Reply-To: <20260622140610.1140558-1-haoxiang_li2024@163.com>
On Mon, Jun 22, 2026 at 10:06:10PM +0800, Haoxiang Li wrote:
> usb_add_gadget_udc_release() drops the gadget device reference when
> registration fails. This invokes qe_udc_release() while qe_udc_probe()
> is still unwinding. Since udc->done is not initialized during probe,
> the release callback dereferences NULL in complete(). It also frees
> the qe_udc object before the remaining probe cleanup accesses it,
> resulting in use-after-free and double-free risks.
>
> Initialize the gadget device explicitly and register it with
> usb_add_gadget(), which leaves the gadget reference owned by the
> driver on failure. Unwind the IRQ, DMA mappings, endpoint resources
> and registers before dropping that reference with usb_put_gadget().
> Make the completion notification conditional because it is only
> installed by the remove path.
>
> Similarly, use usb_del_gadget() during removal so the final gadget
> reference remains held while the controller resources are released.
> Set the completion pointer immediately before dropping the reference,
> then wait for the release callback to finish.
>
> Fixes: d77c1198666d ("usb: gadget: fsl_qe_udc: convert to new style start/stop")
> Cc: stable@kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> ---
> drivers/usb/gadget/udc/fsl_qe_udc.c | 17 +++++++++++------
> 1 file changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
> index bf87285ad13c..f9a59b32e272 100644
> --- a/drivers/usb/gadget/udc/fsl_qe_udc.c
> +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
> @@ -2459,7 +2459,9 @@ static void qe_udc_release(struct device *dev)
> struct qe_udc *udc = container_of(dev, struct qe_udc, gadget.dev);
> int i;
>
> - complete(udc->done);
> + if (udc->done)
> + complete(udc->done);
> +
> cpm_muram_free(cpm_muram_offset(udc->ep_param[0]));
> for (i = 0; i < USB_MAX_ENDPOINTS; i++)
> udc->ep_param[i] = NULL;
> @@ -2489,6 +2491,9 @@ static int qe_udc_probe(struct platform_device *ofdev)
> return -ENOMEM;
> }
>
> + usb_initialize_gadget(&ofdev->dev, &udc->gadget,
> + qe_udc_release);
Odd coding style, why not just one line?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] usb: gadget: tegra-xudc: drain EP pipeline before DMA unmap
From: Greg KH @ 2026-06-25 14:53 UTC (permalink / raw)
To: Vi_ _Ku; +Cc: linux-usb, linux-tegra, stable, thierry.reding, jonathanh, digetx
In-Reply-To: <CAN+vipx-6gco_XMnV+JxbkRegJ=i8tSKFdBN4KcT16UceQduqQ@mail.gmail.com>
On Fri, Jun 05, 2026 at 02:16:47PM +0900, Vi_ _Ku wrote:
> On Tegra186/194/234 the XUDC appears to post a transfer-completion
> event when the DMA write is dispatched to the AXI interconnect, before
> the store is committed to memory. Under SMMU strict mode dma_unmap()
> synchronously removes the IOVA TLB entry. If an in-flight AXI write
> to that IOVA has not yet been committed, the SMMU raises a translation
> fault (fsr=0x402) that permanently wedges the bulk endpoint; the host
> cdc_ncm TX queue stalls and fires NETDEV WATCHDOG after 5 s.
>
> Fix for non-control endpoints: poll EP_THREAD_ACTIVE until the endpoint
> sequencer goes idle before calling dma_unmap(). Follow the poll with an
> MMIO read-back that orders prior CPU writes to device memory. Only
> after that does dma_unmap() invalidate the TLB entry.
>
> On timeout, skip the dma_unmap to avoid triggering the SMMU fault. The
> DMA mapping leaks, but the hardware is already in an unrecoverable state
> at that point.
>
> ep_wait_for_inactive() uses readl_poll_timeout_atomic() (1 µs poll,
> 100 µs timeout), already called from IRQ context in
> __tegra_xudc_ep_dequeue(). Change its return type from void to int so
> both call sites can detect and report a timeout.
>
> Control endpoints (EP0) are excluded: their completions go through the
> control-transfer state machine where the DMA is fully committed before
> req_done is called.
>
> Fixes: d720f0f7bfa0 ("usb: gadget: Add Tegra XUSB device mode controller
> driver")
> Cc: stable@vger.kernel.org
> Cc: Thierry Reding <thierry.reding@gmail.com>
> Cc: Jonathan Hunter <jonathanh@nvidia.com>
> Cc: Dmitry Osipenko <digetx@gmail.com>
> Cc: linux-tegra@vger.kernel.org
> Signed-off-by: Vishal Kumar <vishalmimani008@gmail.com>
Does not match your "From:" line :(
^ permalink raw reply
* Re: [PATCH] USB: misc: uss720: fix refcount leak in submit_async_request()
From: Greg KH @ 2026-06-25 14:51 UTC (permalink / raw)
To: WenTao Liang; +Cc: kees, oneukum, linux-usb, linux-kernel, stable
In-Reply-To: <20260611132952.83931-1-vulab@iscas.ac.cn>
On Thu, Jun 11, 2026 at 09:29:52PM +0800, WenTao Liang wrote:
> When submit_async_request()'s call to usb_submit_urb() fails, the
> error path directly calls destroy_async() on the request structure
> instead of kref_put(). This bypasses the reference counting mechanism
> because the kref is initialized to 1 and the preceding kref_get()
> increments it to 2. The callback function async_complete() will never
> run in this case, so the reference acquired by kref_get() is leaked,
> and the structure is freed while still holding two references.
>
> Fix by replacing destroy_async() with kref_put() in the failure
> branch, properly releasing the extra reference.
>
> Cc: stable@vger.kernel.org
> Fixes: adaa3c6342b2 ("USB: uss720 fixup refcount position")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> drivers/usb/misc/uss720.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
> index b7d3c44b970e..e1eba3cbef0a 100644
> --- a/drivers/usb/misc/uss720.c
> +++ b/drivers/usb/misc/uss720.c
> @@ -168,7 +168,7 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
> ret = usb_submit_urb(rq->urb, mem_flags);
> if (!ret)
> return rq;
> - destroy_async(&rq->ref_count);
> + kref_put(&rq->ref_count, destroy_async);
As
https://sashiko.dev/#/patchset/20260611132952.83931-1-vulab@iscas.ac.cn
shows, this creates a new bug :(
^ permalink raw reply
* Re: [PATCH 1/4] usb: gadget: f_uac1_legacy: fix file handle leaks in gaudio_open_snd_dev()
From: Greg KH @ 2026-06-25 14:00 UTC (permalink / raw)
To: Adrian Korwel; +Cc: linux-usb, stable, heikki.krogerus
In-Reply-To: <20260525202612.680-1-adriank20047@gmail.com>
On Mon, May 25, 2026 at 03:26:09PM -0500, Adrian Korwel wrote:
> gaudio_open_snd_dev() opens the ALSA control device file first, then
> opens the PCM playback device. On two error paths the control file
> handle is leaked:
>
> When filp_open() for the playback device fails, the function returns
> immediately without closing the already-opened control file handle.
>
> When playback_default_hw_params() fails, its return value was ignored
> and both the playback and control file handles were leaked.
>
> Both leaks result in gaudio_cleanup() calling filp_close() on already
> freed file objects, causing a use-after-free.
>
> Fix by closing previously opened file handles before returning on
> each error path, and by checking the return value of
> playback_default_hw_params().
>
> Fixes: d355339eecd9 ("usb: gadget: function: make current f_uac1 implementation legacy")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
> ---
> drivers/usb/gadget/function/u_uac1_legacy.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
Something is really odd with your email system, look at what is on the
list from you for these patches. It looks like:
525 C May 25 Adrian Korwel ( 43) ┬─>[PATCH 1/2] USB: serial: io_ti: fix heap overflow in get_manuf_info()
527 C May 25 Adrian Korwel ( 40) │ └─>[PATCH 2/2] USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
528 T May 25 Adrian Korwel ( 77) └─>Re: [PATCH] USB: serial: io_ti: fix heap overflows in get_manuf_info() and build_i2c_fw_hdr()
623 C May 25 Adrian Korwel ( 54) ┬─>[PATCH 1/4] usb: gadget: f_uac1_legacy: fix file handle leaks in gaudio_open_snd_dev()
624 C May 25 Adrian Korwel ( 64) │ ├─>[PATCH 2/4] usb: gadget: f_uac1_legacy: fix use-after-free caused by bound guard
625 C May 25 Adrian Korwel ( 40) │ ├─>[PATCH 4/4] usb: typec: thunderbolt: cancel work before altmode is removed
626 C May 25 Adrian Korwel ( 35) │ └─>[PATCH 3/4] usb: gadget: f_uac1_legacy: cancel work in f_audio_disable()
627 C May 25 Adrian Korwel ( 40) └─>[PATCH 1/4] USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
628 C May 25 Adrian Korwel ( 40) ├─>[PATCH 4/4] usb: typec: thunderbolt: cancel work before altmode is removed
629 C May 25 Adrian Korwel ( 35) ├─>[PATCH 4/4] usb: gadget: f_uac1_legacy: cancel work in f_audio_disable()
630 C May 25 Adrian Korwel ( 54) ├─>[PATCH 1/4] usb: gadget: f_uac1_legacy: fix file handle leaks in gaudio_open_snd_dev()
631 C May 25 Adrian Korwel ( 64) ├─>[PATCH 2/4] usb: gadget: f_uac1_legacy: fix use-after-free caused by bound guard
632 C May 25 Adrian Korwel ( 64) ├─>[PATCH 3/4] usb: gadget: f_uac1_legacy: fix use-after-free caused by bound guard
633 C May 25 Adrian Korwel ( 35) ├─>[PATCH 3/4] usb: gadget: f_uac1_legacy: cancel work in f_audio_disable()
634 C May 25 Adrian Korwel ( 54) └─>[PATCH 2/4] usb: gadget: f_uac1_legacy: fix file handle leaks in gaudio_open_snd_dev()
636 C May 24 Adrian Korwel ( 41) [PATCH] usb: typec: thunderbolt: cancel work before altmode is removed
637 C May 24 Adrian Korwel ( 62) [PATCH] usb: gadget: f_uac1_legacy: fix file handle leaks in gaudio_open_snd_dev()
You have threading issues, patches in multiple places and resend, and all mixed
up.
Please resend everything that has not been accepted, as new versions, in the
correct way, and we will be glad to review them.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] usb: gadget: f_midi: cancel work before midi is freed
From: Greg KH @ 2026-06-25 13:58 UTC (permalink / raw)
To: Adrian Korwel; +Cc: linux-usb, stable, dave
In-Reply-To: <20260525150139.3038-1-adriank20047@gmail.com>
On Mon, May 25, 2026 at 10:01:39AM -0500, Adrian Korwel wrote:
> f_midi_disable() disables the USB endpoints but does not cancel the
> pending work item before returning. Since f_midi uses the system
> high-priority workqueue (system_highpri_wq) rather than a dedicated
> workqueue, there is no implicit draining when the function is unbound.
>
> The work item f_midi_in_work can therefore be scheduled via
> queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
> after f_midi_free() has run, resulting in a use-after-free when
> f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
> midi->in_req_fifo and midi->in_ports_array.
>
> This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
> Replace tasklet with work") which converted from tasklet_hi_schedule()
> to queue_work() but omitted the cancel_work_sync() call needed to
> ensure the work is not in flight when the structure is freed. Tasklets
> did not require explicit cancellation in this path; workqueues do.
>
> Fix by calling cancel_work_sync() in f_midi_disable() after disabling
> the endpoints, ensuring no work item referencing midi can run after
> teardown begins.
>
> Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
> ---
> drivers/usb/gadget/function/f_midi.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
> index 4d9e4bd700d8..864527bf900c 100644
> --- a/drivers/usb/gadget/function/f_midi.c
> +++ b/drivers/usb/gadget/function/f_midi.c
> @@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
> usb_ep_disable(midi->in_ep);
> usb_ep_disable(midi->out_ep);
>
> + cancel_work_sync(&midi->work);
> +
> /* release IN requests */
> while (kfifo_get(&midi->in_req_fifo, &req))
> free_ep_req(midi->in_ep, req);
> --
> 2.43.0
>
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- This looks like a new version of a previously submitted patch, but you
did not list below the --- line any changes from the previous version.
Please read the section entitled "The canonical patch format" in the
kernel file, Documentation/process/submitting-patches.rst for what
needs to be done here to properly describe this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
^ permalink raw reply
* Re: [PATCH v2] usb: gadget: f_uac1_legacy: fix use-after-free in gaudio_open_snd_dev()
From: Greg KH @ 2026-06-25 13:57 UTC (permalink / raw)
To: Adrian Korwel; +Cc: linux-usb, stable
In-Reply-To: <CADgB2mHJG5dJwzjBML08C4yDUqLHJY=Vmv6yffiiczc98hqnNA@mail.gmail.com>
On Mon, May 25, 2026 at 09:33:12AM -0500, Adrian Korwel wrote:
> [PATCH v3 1/4] usb: gadget: f_uac1_legacy: fix file handle leaks in
> gaudio_open_snd_dev()
This should be in the subject line, not in the body of the emails.
Please resend a new version of all of these in the correct format.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH v2] usbcore: Add quirk for 255-bytes initial config read
From: Greg KH @ 2026-06-25 13:56 UTC (permalink / raw)
To: Nikhil Solanke
Cc: linux-usb, linux-kernel, stern, michal.pecio, stable, corbet,
skhan, linux-doc
In-Reply-To: <20260623161035.5792-1-nikhilsolanke5@gmail.com>
On Tue, Jun 23, 2026 at 09:40:35PM +0530, Nikhil Solanke wrote:
> @@ -912,6 +915,13 @@ int usb_get_configuration(struct usb_device *dev)
> unsigned char *bigbuffer;
> struct usb_config_descriptor *desc;
> int result;
> + /*
> + * Devices with quirky firmware will stall or reset when asked only for
> + * the configuration header. This variable decides which size to use in
> + * that case, if the quirk for that device was set.
> + */
> + size_t usb_config_req_size = (dev->quirks & USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE)
> + ? USB_CONFIG_WINDOWS_REQ_SIZE : USB_DT_CONFIG_SIZE;
Please just use if () lines for code logic like this. Don't abuse ?:
stuff as it's not needed. Remember, we write code for people first,
compilers second, and in this case the compiler doesn't care either way
at all, but an if () line makes people much happier.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] usb: renesas_usbhs: Check pipe allocation in host pipe init
From: Greg KH @ 2026-06-25 13:55 UTC (permalink / raw)
To: Haoxiang Li; +Cc: kees, linux-usb, linux-kernel
In-Reply-To: <20260622114521.1022197-1-haoxiang_li2024@163.com>
On Mon, Jun 22, 2026 at 07:45:21PM +0800, Haoxiang Li wrote:
> usbhsh_pipe_init_for_host() allocates pipes with usbhs_dcp_malloc()
> or usbhs_pipe_malloc(), both of which may return NULL. The returned
> pointer is dereferenced unconditionally when clearing pipe->mod_private.
>
> Check the returned pipe before using it to avoid a NULL pointer
> dereference on pipe allocation/setup failure.
>
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> ---
> drivers/usb/renesas_usbhs/mod_host.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/renesas_usbhs/mod_host.c b/drivers/usb/renesas_usbhs/mod_host.c
> index f7ef3a9f82a4..11244cf3408d 100644
> --- a/drivers/usb/renesas_usbhs/mod_host.c
> +++ b/drivers/usb/renesas_usbhs/mod_host.c
> @@ -1441,6 +1441,9 @@ static void usbhsh_pipe_init_for_host(struct usbhs_priv *priv)
> dir_in);
> }
>
> + if (!pipe)
> + return;
No, you just leaked memory and caused the system to be in an unknown
state, which is probably worse off than the crash that would have
happened.
Please fix this properly, if you really have ever hit this before.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] usb: gadget: f_uac1_legacy: fix inverted NULL check after kstrndup()
From: Frank Li @ 2026-06-25 12:15 UTC (permalink / raw)
To: Xu Yang
Cc: gregkh, kees, christophe.jaillet, xu.yang_2, hataegu0826, balbi,
andrzej.p, linux-usb, linux-kernel, imx
In-Reply-To: <20260625113154.1954813-1-xu.yang_2@oss.nxp.com>
On Thu, Jun 25, 2026 at 07:31:54PM +0800, Xu Yang wrote:
>
> From: Xu Yang <xu.yang_2@nxp.com>
>
> kstrndup() returns NULL on allocation failure. The condition was
> checking 'if (tmp)' to detect failure, but this is inverted — it
> would treat a successful allocation as an error and return -ENOMEM
> while leaking the string, and proceed with a NULL pointer on failure.
>
> Fix by changing the condition to 'if (!tmp)'.
>
> Fixes: 0854611a19ae ("usb: gadget: f_uac1: add configfs support")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-sonnet-4-6
> Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> drivers/usb/gadget/function/f_uac1_legacy.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
> index 5d201a2e30e7..e9f2632ce785 100644
> --- a/drivers/usb/gadget/function/f_uac1_legacy.c
> +++ b/drivers/usb/gadget/function/f_uac1_legacy.c
> @@ -914,7 +914,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
> goto end; \
> \
> tmp = kstrndup(page, len, GFP_KERNEL); \
> - if (tmp) { \
> + if (!tmp) { \
> ret = -ENOMEM; \
> goto end; \
> } \
> --
> 2.34.1
>
>
^ permalink raw reply
* [PATCH] thunderbolt: bound the DROM dual link port number before indexing sw->ports
From: Bryam Vargas via B4 Relay @ 2026-06-25 11:54 UTC (permalink / raw)
To: Yehezkel Bernat, Mika Westerberg, Andreas Noever
Cc: linux-usb, Greg Kroah-Hartman, linux-kernel
From: Bryam Vargas <hexlabsecurity@proton.me>
tb_drom_parse_entry_port() validates the device-supplied header->index
against sw->config.max_port_number before indexing sw->ports[], but the
sibling field entry->dual_link_port_nr -- a 6-bit value also read from
the DROM -- indexes the same array with no such check. A malicious or
malformed Thunderbolt device can set dual_link_port_nr beyond the
allocated sw->ports[] (max_port_number + 1 entries), producing an
out-of-bounds tb_port pointer that is stored and later dereferenced.
Reject a port entry whose dual_link_port_nr exceeds max_port_number,
the same bound already applied to header->index.
Fixes: cd22e73bdf5e ("thunderbolt: Read port configuration from eeprom.")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
---
Reachable only from the device side -- a malicious or malformed DROM, read at
enumeration -- so this hardens against an untrusted Thunderbolt device, not a
remote attacker.
I have no Thunderbolt hardware, so this is by source inspection plus an
out-of-tree KASAN module mirroring the &sw->ports[dual_link_port_nr] indexing:
with dual_link_port_nr = 63 on an 8-port switch the unpatched arithmetic
reports a slab-out-of-bounds read 1864 bytes past the kmalloc'd ports[]
object, while the bound and an in-range control run clean. Reproducer on
request.
---
drivers/thunderbolt/eeprom.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 5681c17f82ec..2a13fa6888ba 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -394,9 +394,16 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
return -EIO;
}
port->link_nr = entry->link_nr;
- if (entry->has_dual_link_port)
+ if (entry->has_dual_link_port) {
+ if (entry->dual_link_port_nr > sw->config.max_port_number) {
+ tb_sw_warn(sw,
+ "port entry has invalid dual link port number %u\n",
+ entry->dual_link_port_nr);
+ return -EIO;
+ }
port->dual_link_port =
&port->sw->ports[entry->dual_link_port_nr];
+ }
}
return 0;
}
---
base-commit: 502d801f0ab03e4f32f9a33d203154ce84887921
change-id: 20260625-b4-disp-9f8d8a2d-aae0ecad10e7
Best regards,
--
Bryam Vargas <hexlabsecurity@proton.me>
^ permalink raw reply related
* Re: [PATCH v4 2/9] usb: misc: qcom_eud: add sysfs attribute for port selection
From: Konrad Dybcio @ 2026-06-25 11:51 UTC (permalink / raw)
To: Elson Serrao, Bjorn Andersson, Dmitry Baryshkov,
Greg Kroah-Hartman, Konrad Dybcio, Krzysztof Kozlowski,
Rob Herring, Conor Dooley, Souradeep Chowdhury
Cc: linux-arm-msm, devicetree, linux-usb, linux-kernel
In-Reply-To: <20260501170635.2641748-3-elson.serrao@oss.qualcomm.com>
On 5/1/26 7:06 PM, Elson Serrao wrote:
> EUD can be mapped to either the primary USB port or the secondary USB port
> depending on the value of the EUD_PORT_SEL register. Add a 'port' sysfs
> attribute to allow userspace to select which port EUD should operate on
> and update the ABI documentation. This is needed for systems with dual
> USB ports where EUD needs to be accessible on either port depending on the
> system configuration and use case.
>
> Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com>
> ---
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Konrad
^ permalink raw reply
* [PATCH] usb: gadget: f_uac1_legacy: fix inverted NULL check after kstrndup()
From: Xu Yang @ 2026-06-25 11:31 UTC (permalink / raw)
To: gregkh, kees, christophe.jaillet, xu.yang_2, hataegu0826
Cc: balbi, andrzej.p, linux-usb, linux-kernel, imx
From: Xu Yang <xu.yang_2@nxp.com>
kstrndup() returns NULL on allocation failure. The condition was
checking 'if (tmp)' to detect failure, but this is inverted — it
would treat a successful allocation as an error and return -ENOMEM
while leaking the string, and proceed with a NULL pointer on failure.
Fix by changing the condition to 'if (!tmp)'.
Fixes: 0854611a19ae ("usb: gadget: f_uac1: add configfs support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
---
drivers/usb/gadget/function/f_uac1_legacy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
index 5d201a2e30e7..e9f2632ce785 100644
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -914,7 +914,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
goto end; \
\
tmp = kstrndup(page, len, GFP_KERNEL); \
- if (tmp) { \
+ if (!tmp) { \
ret = -ENOMEM; \
goto end; \
} \
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v4 0/2] tracing: Move non-trace_printk prototypes into trace_controls.h
From: Jani Nikula @ 2026-06-25 11:05 UTC (permalink / raw)
To: Steven Rostedt, linux-kernel, linux-trace-kernel
Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Linus Torvalds, Sebastian Andrzej Siewior, John Ogness,
Thomas Gleixner, Peter Zijlstra, Julia Lawall, Yury Norov,
linux-doc, linux-kbuild, linuxppc-dev, dri-devel, linux-stm32,
linux-arm-kernel, linux-rdma, linux-usb, linux-ext4, linux-nfs,
kvm, intel-gfx
In-Reply-To: <20260625104007.041432666@kernel.org>
On Thu, 25 Jun 2026, Steven Rostedt <rostedt@kernel.org> wrote:
> Remove trace_printk.h by creating a trace_controls.h for those places that
> need access to tracing prototypes like tracing_off() and for the places that
> need trace_printk() directly, to have it included directly.
>
> Changse since v3: https://lore.kernel.org/all/20260624081806.120105649@kernel.org/
>
> - Always include trace_controls.h in rcu.h (kernel test robot)
>
> There are other configs that may include tracing_off() in rcu.h besides
> the one that had the include of trace_controls.h. Just always include
> it in that header to be safe.
>
> Steven Rostedt (2):
> tracing: Move non-trace_printk prototypes into trace_controls.h
> tracing: Remove trace_printk.h from kernel.h
>
> ----
> arch/powerpc/kvm/book3s_xics.c | 1 +
> arch/powerpc/xmon/xmon.c | 1 +
> arch/s390/kernel/ipl.c | 1 +
> arch/s390/kernel/machine_kexec.c | 1 +
> drivers/gpu/drm/i915/gt/intel_gtt.h | 1 +
> drivers/gpu/drm/i915/i915_gem.h | 2 ++
For the i915 parts,
Acked-by: Jani Nikula <jani.nikula@intel.com>
for merging via whichever tree.
> drivers/hwtracing/stm/dummy_stm.c | 1 +
> drivers/infiniband/hw/hfi1/trace_dbg.h | 1 +
> drivers/tty/sysrq.c | 1 +
> drivers/usb/early/xhci-dbc.c | 1 +
> fs/ext4/inline.c | 1 +
> include/linux/ftrace.h | 2 ++
> include/linux/kernel.h | 1 -
> include/linux/sunrpc/debug.h | 1 +
> include/linux/trace_controls.h | 54 ++++++++++++++++++++++++++++++++
> include/linux/trace_printk.h | 56 ++--------------------------------
> kernel/debug/debug_core.c | 1 +
> kernel/panic.c | 1 +
> kernel/rcu/rcu.h | 1 +
> kernel/rcu/rcutorture.c | 1 +
> kernel/trace/ring_buffer_benchmark.c | 1 +
> kernel/trace/trace.h | 1 +
> kernel/trace/trace_benchmark.c | 1 +
> lib/sys_info.c | 1 +
> samples/fprobe/fprobe_example.c | 1 +
> samples/ftrace/ftrace-direct-too.c | 1 -
> samples/trace_printk/trace-printk.c | 1 +
> 27 files changed, 82 insertions(+), 55 deletions(-)
> create mode 100644 include/linux/trace_controls.h
--
Jani Nikula, Intel
^ permalink raw reply
* [PATCH v4 1/2] tracing: Move non-trace_printk prototypes into trace_controls.h
From: Steven Rostedt @ 2026-06-25 10:40 UTC (permalink / raw)
To: linux-kernel, linux-trace-kernel
Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Linus Torvalds, Sebastian Andrzej Siewior, John Ogness,
Thomas Gleixner, Peter Zijlstra, Julia Lawall, Yury Norov,
linux-doc, linux-kbuild, linuxppc-dev, dri-devel, linux-stm32,
linux-arm-kernel, linux-rdma, linux-usb, linux-ext4, linux-nfs,
kvm, intel-gfx
In-Reply-To: <20260625104007.041432666@kernel.org>
From: Steven Rostedt <rostedt@goodmis.org>
Remove the prototypes of the code that is not associated with
trace_printk() from trace_printk.h.
These control functions as well as ftrace_dump() and trace_dump_stack()
are used in cases where things go wrong. The main use case is to do a
trace_dump_stack(); tracing_off(); ftrace_dump(); in a place that detected
that something went wrong, whereas, trace_printk() is added to normal code
during debugging and removed before committing upstream. The dump code is
fine to keep in production.
Suggested-by: Yury Norov <yury.norov@gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
Changes since v3: https://patch.msgid.link/20260624081948.147764194@kernel.org
- Move include out of #if statement in rcu.h
kernel test robot found other configs that could require the
control functions in rcu.h. Just always include it in that file.
arch/powerpc/xmon/xmon.c | 1 +
arch/s390/kernel/ipl.c | 1 +
arch/s390/kernel/machine_kexec.c | 1 +
drivers/gpu/drm/i915/i915_gem.h | 1 +
drivers/tty/sysrq.c | 1 +
include/linux/trace_controls.h | 54 ++++++++++++++++++++++++++++++++
include/linux/trace_printk.h | 51 ------------------------------
kernel/debug/debug_core.c | 1 +
kernel/panic.c | 1 +
kernel/rcu/rcu.h | 1 +
kernel/rcu/rcutorture.c | 1 +
kernel/trace/trace.h | 1 +
kernel/trace/trace_benchmark.c | 1 +
lib/sys_info.c | 1 +
14 files changed, 66 insertions(+), 51 deletions(-)
create mode 100644 include/linux/trace_controls.h
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index cb3a3244ae6f..2135f319e0dd 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -27,6 +27,7 @@
#include <linux/highmem.h>
#include <linux/security.h>
#include <linux/debugfs.h>
+#include <linux/trace_controls.h>
#include <asm/ptrace.h>
#include <asm/smp.h>
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 3c346b02ceb9..baac66cc4de4 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -22,6 +22,7 @@
#include <linux/debug_locks.h>
#include <linux/vmalloc.h>
#include <linux/secure_boot.h>
+#include <linux/trace_controls.h>
#include <asm/asm-extable.h>
#include <asm/machine.h>
#include <asm/diag.h>
diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
index baeb3dcfc1c8..33f9a89eb3ad 100644
--- a/arch/s390/kernel/machine_kexec.c
+++ b/arch/s390/kernel/machine_kexec.c
@@ -12,6 +12,7 @@
#include <linux/delay.h>
#include <linux/reboot.h>
#include <linux/ftrace.h>
+#include <linux/trace_controls.h>
#include <linux/debug_locks.h>
#include <linux/cpufeature.h>
#include <asm/guarded_storage.h>
diff --git a/drivers/gpu/drm/i915/i915_gem.h b/drivers/gpu/drm/i915/i915_gem.h
index 20b3cb29cfff..1da8fb61c09e 100644
--- a/drivers/gpu/drm/i915/i915_gem.h
+++ b/drivers/gpu/drm/i915/i915_gem.h
@@ -116,6 +116,7 @@ int i915_gem_open(struct drm_i915_private *i915, struct drm_file *file);
#endif
#if IS_ENABLED(CONFIG_DRM_I915_TRACE_GEM)
+#include <linux/trace_controls.h>
#define GEM_TRACE(...) trace_printk(__VA_ARGS__)
#define GEM_TRACE_ERR(...) do { \
pr_err(__VA_ARGS__); \
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index c2e4b31b699a..d3f72dc430b8 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -324,6 +324,7 @@ static const struct sysrq_key_op sysrq_showstate_blocked_op = {
};
#ifdef CONFIG_TRACING
+#include <linux/trace_controls.h>
#include <linux/ftrace.h>
static void sysrq_ftrace_dump(u8 key)
diff --git a/include/linux/trace_controls.h b/include/linux/trace_controls.h
new file mode 100644
index 000000000000..995b97e963b4
--- /dev/null
+++ b/include/linux/trace_controls.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_TRACE_CONTROLS_H
+#define _LINUX_TRACE_CONTROLS_H
+
+
+/*
+ * General tracing related utility functions - trace_printk(),
+ * tracing_on/tracing_off and tracing_start()/tracing_stop
+ *
+ * Use tracing_on/tracing_off when you want to quickly turn on or off
+ * tracing. It simply enables or disables the recording of the trace events.
+ * This also corresponds to the user space /sys/kernel/tracing/tracing_on
+ * file, which gives a means for the kernel and userspace to interact.
+ * Place a tracing_off() in the kernel where you want tracing to end.
+ * From user space, examine the trace, and then echo 1 > tracing_on
+ * to continue tracing.
+ *
+ * tracing_stop/tracing_start has slightly more overhead. It is used
+ * by things like suspend to ram where disabling the recording of the
+ * trace is not enough, but tracing must actually stop because things
+ * like calling smp_processor_id() may crash the system.
+ *
+ * Most likely, you want to use tracing_on/tracing_off.
+ */
+enum ftrace_dump_mode {
+ DUMP_NONE,
+ DUMP_ALL,
+ DUMP_ORIG,
+ DUMP_PARAM,
+};
+
+#ifdef CONFIG_TRACING
+void tracing_on(void);
+void tracing_off(void);
+int tracing_is_on(void);
+void tracing_snapshot(void);
+void tracing_snapshot_alloc(void);
+void tracing_start(void);
+void tracing_stop(void);
+void trace_dump_stack(int skip);
+void ftrace_dump(enum ftrace_dump_mode oops_dump_mode);
+#else
+static inline void tracing_start(void) { }
+static inline void tracing_stop(void) { }
+static inline void tracing_on(void) { }
+static inline void tracing_off(void) { }
+static inline int tracing_is_on(void) { return 0; }
+static inline void tracing_snapshot(void) { }
+static inline void tracing_snapshot_alloc(void) { }
+static inline void trace_dump_stack(int skip) { }
+static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
+#endif
+
+#endif /* _LINUX_TRACE_CONTROLS_H */
diff --git a/include/linux/trace_printk.h b/include/linux/trace_printk.h
index 3d54f440dccf..a488ea9e9f85 100644
--- a/include/linux/trace_printk.h
+++ b/include/linux/trace_printk.h
@@ -7,43 +7,7 @@
#include <linux/stddef.h>
#include <linux/stringify.h>
-/*
- * General tracing related utility functions - trace_printk(),
- * tracing_on/tracing_off and tracing_start()/tracing_stop
- *
- * Use tracing_on/tracing_off when you want to quickly turn on or off
- * tracing. It simply enables or disables the recording of the trace events.
- * This also corresponds to the user space /sys/kernel/tracing/tracing_on
- * file, which gives a means for the kernel and userspace to interact.
- * Place a tracing_off() in the kernel where you want tracing to end.
- * From user space, examine the trace, and then echo 1 > tracing_on
- * to continue tracing.
- *
- * tracing_stop/tracing_start has slightly more overhead. It is used
- * by things like suspend to ram where disabling the recording of the
- * trace is not enough, but tracing must actually stop because things
- * like calling smp_processor_id() may crash the system.
- *
- * Most likely, you want to use tracing_on/tracing_off.
- */
-
-enum ftrace_dump_mode {
- DUMP_NONE,
- DUMP_ALL,
- DUMP_ORIG,
- DUMP_PARAM,
-};
-
#ifdef CONFIG_TRACING
-void tracing_on(void);
-void tracing_off(void);
-int tracing_is_on(void);
-void tracing_snapshot(void);
-void tracing_snapshot_alloc(void);
-
-extern void tracing_start(void);
-extern void tracing_stop(void);
-
static inline __printf(1, 2)
void ____trace_printk_check_format(const char *fmt, ...)
{
@@ -149,8 +113,6 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
extern int __trace_bputs(unsigned long ip, const char *str);
extern int __trace_puts(unsigned long ip, const char *str);
-extern void trace_dump_stack(int skip);
-
/*
* The double __builtin_constant_p is because gcc will give us an error
* if we try to allocate the static variable to fmt if it is not a
@@ -173,19 +135,7 @@ __ftrace_vbprintk(unsigned long ip, const char *fmt, va_list ap);
extern __printf(2, 0) int
__ftrace_vprintk(unsigned long ip, const char *fmt, va_list ap);
-
-extern void ftrace_dump(enum ftrace_dump_mode oops_dump_mode);
#else
-static inline void tracing_start(void) { }
-static inline void tracing_stop(void) { }
-static inline void trace_dump_stack(int skip) { }
-
-static inline void tracing_on(void) { }
-static inline void tracing_off(void) { }
-static inline int tracing_is_on(void) { return 0; }
-static inline void tracing_snapshot(void) { }
-static inline void tracing_snapshot_alloc(void) { }
-
static inline __printf(1, 2)
int trace_printk(const char *fmt, ...)
{
@@ -196,7 +146,6 @@ ftrace_vprintk(const char *fmt, va_list ap)
{
return 0;
}
-static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
#endif /* CONFIG_TRACING */
#endif
diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index b276504c1c6b..f9c83a470c98 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -27,6 +27,7 @@
#define pr_fmt(fmt) "KGDB: " fmt
+#include <linux/trace_controls.h>
#include <linux/pid_namespace.h>
#include <linux/clocksource.h>
#include <linux/serial_core.h>
diff --git a/kernel/panic.c b/kernel/panic.c
index 213725b612aa..1415e910371d 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -9,6 +9,7 @@
* This function is used through-out the kernel (including mm and fs)
* to indicate a major problem.
*/
+#include <linux/trace_controls.h>
#include <linux/debug_locks.h>
#include <linux/sched/debug.h>
#include <linux/interrupt.h>
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index fa6d30ce73d1..735a80df0b30 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -12,6 +12,7 @@
#include <linux/slab.h>
#include <trace/events/rcu.h>
+#include <linux/trace_controls.h>
/*
* Grace-period counter management.
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 882a158ada7b..76bf0184b267 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -39,6 +39,7 @@
#include <linux/srcu.h>
#include <linux/slab.h>
#include <linux/trace_clock.h>
+#include <linux/trace_controls.h>
#include <asm/byteorder.h>
#include <linux/torture.h>
#include <linux/vmalloc.h>
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 80fe152af1dd..2537c33ddd49 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -22,6 +22,7 @@
#include <linux/ctype.h>
#include <linux/once_lite.h>
#include <linux/ftrace_regs.h>
+#include <linux/trace_controls.h>
#include <linux/llist.h>
#include "pid_list.h"
diff --git a/kernel/trace/trace_benchmark.c b/kernel/trace/trace_benchmark.c
index e19c32f2a938..69cc39008c36 100644
--- a/kernel/trace/trace_benchmark.c
+++ b/kernel/trace/trace_benchmark.c
@@ -3,6 +3,7 @@
#include <linux/module.h>
#include <linux/kthread.h>
#include <linux/trace_clock.h>
+#include <linux/trace_controls.h>
#define CREATE_TRACE_POINTS
#include "trace_benchmark.h"
diff --git a/lib/sys_info.c b/lib/sys_info.c
index f32a06ec9ed4..e3c9ca05601b 100644
--- a/lib/sys_info.c
+++ b/lib/sys_info.c
@@ -8,6 +8,7 @@
#include <linux/ftrace.h>
#include <linux/nmi.h>
#include <linux/sched/debug.h>
+#include <linux/trace_controls.h>
#include <linux/string.h>
#include <linux/sysctl.h>
--
2.53.0
^ permalink raw reply related
* [PATCH v4 2/2] tracing: Remove trace_printk.h from kernel.h
From: Steven Rostedt @ 2026-06-25 10:40 UTC (permalink / raw)
To: linux-kernel, linux-trace-kernel
Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Linus Torvalds, Sebastian Andrzej Siewior, John Ogness,
Thomas Gleixner, Peter Zijlstra, Julia Lawall, Yury Norov,
linux-doc, linux-kbuild, linuxppc-dev, dri-devel, linux-stm32,
linux-arm-kernel, linux-rdma, linux-usb, linux-ext4, linux-nfs,
kvm, intel-gfx
In-Reply-To: <20260625104007.041432666@kernel.org>
From: Steven Rostedt <rostedt@goodmis.org>
There have been complaints about trace_printk.h causing more build time
for being in kernel.h if it changes. There is also an effort to clean up
kernel.h to have it not include unneeded header files. Move trace_printk.h
out of kernel.h and place it in the headers and C files that use it.
Link: https://lore.kernel.org/all/CAHk-=wikCBeVFjVXiY4o-oepdbjAoir5+TcAgtL12c4u1TpZLQ@mail.gmail.com/
Suggested-by: Yury Norov <yury.norov@gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
arch/powerpc/kvm/book3s_xics.c | 1 +
drivers/gpu/drm/i915/gt/intel_gtt.h | 1 +
drivers/gpu/drm/i915/i915_gem.h | 1 +
drivers/hwtracing/stm/dummy_stm.c | 1 +
drivers/infiniband/hw/hfi1/trace_dbg.h | 1 +
drivers/usb/early/xhci-dbc.c | 1 +
fs/ext4/inline.c | 1 +
include/linux/ftrace.h | 2 ++
include/linux/kernel.h | 1 -
include/linux/sunrpc/debug.h | 1 +
include/linux/trace_printk.h | 5 +++--
kernel/trace/ring_buffer_benchmark.c | 1 +
samples/fprobe/fprobe_example.c | 1 +
samples/ftrace/ftrace-direct-too.c | 1 -
samples/trace_printk/trace-printk.c | 1 +
15 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
index 74a44fa702b0..ef5eb596a56e 100644
--- a/arch/powerpc/kvm/book3s_xics.c
+++ b/arch/powerpc/kvm/book3s_xics.c
@@ -26,6 +26,7 @@
#if 1
#define XICS_DBG(fmt...) do { } while (0)
#else
+#include <linux/trace_printk.h>
#define XICS_DBG(fmt...) trace_printk(fmt)
#endif
diff --git a/drivers/gpu/drm/i915/gt/intel_gtt.h b/drivers/gpu/drm/i915/gt/intel_gtt.h
index b54ee4f25af1..f6f223090760 100644
--- a/drivers/gpu/drm/i915/gt/intel_gtt.h
+++ b/drivers/gpu/drm/i915/gt/intel_gtt.h
@@ -35,6 +35,7 @@
#define I915_GFP_ALLOW_FAIL (GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_NOWARN)
#if IS_ENABLED(CONFIG_DRM_I915_TRACE_GTT)
+#include <linux/trace_printk.h>
#define GTT_TRACE(...) trace_printk(__VA_ARGS__)
#else
#define GTT_TRACE(...)
diff --git a/drivers/gpu/drm/i915/i915_gem.h b/drivers/gpu/drm/i915/i915_gem.h
index 1da8fb61c09e..f490052e8964 100644
--- a/drivers/gpu/drm/i915/i915_gem.h
+++ b/drivers/gpu/drm/i915/i915_gem.h
@@ -117,6 +117,7 @@ int i915_gem_open(struct drm_i915_private *i915, struct drm_file *file);
#if IS_ENABLED(CONFIG_DRM_I915_TRACE_GEM)
#include <linux/trace_controls.h>
+#include <linux/trace_printk.h>
#define GEM_TRACE(...) trace_printk(__VA_ARGS__)
#define GEM_TRACE_ERR(...) do { \
pr_err(__VA_ARGS__); \
diff --git a/drivers/hwtracing/stm/dummy_stm.c b/drivers/hwtracing/stm/dummy_stm.c
index 38528ffdc0b3..7c5e48ebfb9f 100644
--- a/drivers/hwtracing/stm/dummy_stm.c
+++ b/drivers/hwtracing/stm/dummy_stm.c
@@ -8,6 +8,7 @@
*/
#undef DEBUG
+#include <linux/trace_printk.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/slab.h>
diff --git a/drivers/infiniband/hw/hfi1/trace_dbg.h b/drivers/infiniband/hw/hfi1/trace_dbg.h
index 58304b91380f..30df5e246586 100644
--- a/drivers/infiniband/hw/hfi1/trace_dbg.h
+++ b/drivers/infiniband/hw/hfi1/trace_dbg.h
@@ -103,6 +103,7 @@ __hfi1_trace_def(IOCTL);
*/
#ifdef HFI1_EARLY_DBG
+#include <linux/trace_printk.h>
#define hfi1_dbg_early(fmt, ...) \
trace_printk(fmt, ##__VA_ARGS__)
#else
diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
index 41118bba9197..955c73bd601f 100644
--- a/drivers/usb/early/xhci-dbc.c
+++ b/drivers/usb/early/xhci-dbc.c
@@ -30,6 +30,7 @@ static struct xdbc_state xdbc;
static bool early_console_keep;
#ifdef XDBC_TRACE
+#include <linux/trace_printk.h>
#define xdbc_trace trace_printk
#else
static inline void xdbc_trace(const char *fmt, ...) { }
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 8045e4ff270c..0eff4a0c6a6c 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -934,6 +934,7 @@ static int ext4_da_convert_inline_data_to_extent(struct address_space *mapping,
}
#ifdef INLINE_DIR_DEBUG
+#include <linux/trace_printk.h>
void ext4_show_inline_dir(struct inode *dir, struct buffer_head *bh,
void *inline_start, int inline_size)
{
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 02bc5027523a..b5336a81e619 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -8,6 +8,8 @@
#define _LINUX_FTRACE_H
#include <linux/trace_recursion.h>
+#include <linux/trace_controls.h>
+#include <linux/trace_printk.h>
#include <linux/trace_clock.h>
#include <linux/jump_label.h>
#include <linux/kallsyms.h>
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index e5570a16cbb1..e87a40fbd152 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -31,7 +31,6 @@
#include <linux/build_bug.h>
#include <linux/sprintf.h>
#include <linux/static_call_types.h>
-#include <linux/trace_printk.h>
#include <linux/util_macros.h>
#include <linux/wordpart.h>
diff --git a/include/linux/sunrpc/debug.h b/include/linux/sunrpc/debug.h
index ab61bed2f7af..7524f5d82fba 100644
--- a/include/linux/sunrpc/debug.h
+++ b/include/linux/sunrpc/debug.h
@@ -29,6 +29,7 @@ extern unsigned int nlm_debug;
# define ifdebug(fac) if (unlikely(rpc_debug & RPCDBG_##fac))
# if IS_ENABLED(CONFIG_SUNRPC_DEBUG_TRACE)
+# include <linux/trace_printk.h>
# define __sunrpc_printk(fmt, ...) trace_printk(fmt, ##__VA_ARGS__)
# else
# define __sunrpc_printk(fmt, ...) printk(KERN_DEFAULT fmt, ##__VA_ARGS__)
diff --git a/include/linux/trace_printk.h b/include/linux/trace_printk.h
index a488ea9e9f85..74ce4f8995c4 100644
--- a/include/linux/trace_printk.h
+++ b/include/linux/trace_printk.h
@@ -1,11 +1,12 @@
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _LINUX_TRACE_PRINTK_H
#define _LINUX_TRACE_PRINTK_H
+#if !defined(__ASSEMBLY__) && !defined(__GENKSYMS__) && !defined(BUILD_VDSO)
-#include <linux/compiler_attributes.h>
#include <linux/instruction_pointer.h>
#include <linux/stddef.h>
#include <linux/stringify.h>
+#include <linux/stdarg.h>
#ifdef CONFIG_TRACING
static inline __printf(1, 2)
@@ -147,5 +148,5 @@ ftrace_vprintk(const char *fmt, va_list ap)
return 0;
}
#endif /* CONFIG_TRACING */
-
+#endif /* !defined(__ASSEMBLY__) && !defined(__GENKSYMS__) && !defined(BUILD_VDSO) */
#endif
diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
index 593e3b59e42e..2bb25caebb75 100644
--- a/kernel/trace/ring_buffer_benchmark.c
+++ b/kernel/trace/ring_buffer_benchmark.c
@@ -5,6 +5,7 @@
* Copyright (C) 2009 Steven Rostedt <srostedt@redhat.com>
*/
#include <linux/ring_buffer.h>
+#include <linux/trace_printk.h>
#include <linux/completion.h>
#include <linux/kthread.h>
#include <uapi/linux/sched/types.h>
diff --git a/samples/fprobe/fprobe_example.c b/samples/fprobe/fprobe_example.c
index bfe98ce826f3..de81b9b4ca7d 100644
--- a/samples/fprobe/fprobe_example.c
+++ b/samples/fprobe/fprobe_example.c
@@ -12,6 +12,7 @@
#define pr_fmt(fmt) "%s: " fmt, __func__
+#include <linux/trace_printk.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/fprobe.h>
diff --git a/samples/ftrace/ftrace-direct-too.c b/samples/ftrace/ftrace-direct-too.c
index bf2411aa6fd7..159190f4103f 100644
--- a/samples/ftrace/ftrace-direct-too.c
+++ b/samples/ftrace/ftrace-direct-too.c
@@ -1,6 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/module.h>
-
#include <linux/mm.h> /* for handle_mm_fault() */
#include <linux/ftrace.h>
#if !defined(CONFIG_ARM64) && !defined(CONFIG_PPC32)
diff --git a/samples/trace_printk/trace-printk.c b/samples/trace_printk/trace-printk.c
index cfc159580263..ff37aeb8523e 100644
--- a/samples/trace_printk/trace-printk.c
+++ b/samples/trace_printk/trace-printk.c
@@ -1,4 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-only
+#include <linux/trace_printk.h>
#include <linux/module.h>
#include <linux/kthread.h>
#include <linux/irq_work.h>
--
2.53.0
^ permalink raw reply related
* [PATCH v4 0/2] tracing: Move non-trace_printk prototypes into trace_controls.h
From: Steven Rostedt @ 2026-06-25 10:40 UTC (permalink / raw)
To: linux-kernel, linux-trace-kernel
Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Linus Torvalds, Sebastian Andrzej Siewior, John Ogness,
Thomas Gleixner, Peter Zijlstra, Julia Lawall, Yury Norov,
linux-doc, linux-kbuild, linuxppc-dev, dri-devel, linux-stm32,
linux-arm-kernel, linux-rdma, linux-usb, linux-ext4, linux-nfs,
kvm, intel-gfx
Remove trace_printk.h by creating a trace_controls.h for those places that
need access to tracing prototypes like tracing_off() and for the places that
need trace_printk() directly, to have it included directly.
Changse since v3: https://lore.kernel.org/all/20260624081806.120105649@kernel.org/
- Always include trace_controls.h in rcu.h (kernel test robot)
There are other configs that may include tracing_off() in rcu.h besides
the one that had the include of trace_controls.h. Just always include
it in that header to be safe.
Steven Rostedt (2):
tracing: Move non-trace_printk prototypes into trace_controls.h
tracing: Remove trace_printk.h from kernel.h
----
arch/powerpc/kvm/book3s_xics.c | 1 +
arch/powerpc/xmon/xmon.c | 1 +
arch/s390/kernel/ipl.c | 1 +
arch/s390/kernel/machine_kexec.c | 1 +
drivers/gpu/drm/i915/gt/intel_gtt.h | 1 +
drivers/gpu/drm/i915/i915_gem.h | 2 ++
drivers/hwtracing/stm/dummy_stm.c | 1 +
drivers/infiniband/hw/hfi1/trace_dbg.h | 1 +
drivers/tty/sysrq.c | 1 +
drivers/usb/early/xhci-dbc.c | 1 +
fs/ext4/inline.c | 1 +
include/linux/ftrace.h | 2 ++
include/linux/kernel.h | 1 -
include/linux/sunrpc/debug.h | 1 +
include/linux/trace_controls.h | 54 ++++++++++++++++++++++++++++++++
include/linux/trace_printk.h | 56 ++--------------------------------
kernel/debug/debug_core.c | 1 +
kernel/panic.c | 1 +
kernel/rcu/rcu.h | 1 +
kernel/rcu/rcutorture.c | 1 +
kernel/trace/ring_buffer_benchmark.c | 1 +
kernel/trace/trace.h | 1 +
kernel/trace/trace_benchmark.c | 1 +
lib/sys_info.c | 1 +
samples/fprobe/fprobe_example.c | 1 +
samples/ftrace/ftrace-direct-too.c | 1 -
samples/trace_printk/trace-printk.c | 1 +
27 files changed, 82 insertions(+), 55 deletions(-)
create mode 100644 include/linux/trace_controls.h
^ permalink raw reply
* Re: [PATCH stable 5.15] xhci: fix memory leak regression when freeing xhci vdev devices depth first
From: Sasha Levin @ 2026-06-25 10:41 UTC (permalink / raw)
To: stable
Cc: Sasha Levin, gregkh, WeitaoWang-oc, linux-usb, mathias.nyman,
bcm-kernel-feedback-list, Mathias Nyman, David Wang, Michal Pecio,
Justin Chen
In-Reply-To: <20260624034938.4126679-1-justin.chen@broadcom.com>
> xhci: fix memory leak regression when freeing xhci vdev devices depth first
>
> Pass xhci->devs[slot_id] instead of the reused vdev temporary to
> xhci_free_virt_device() in the leaf path of
> xhci_free_virt_devices_depth_first().
Queued for 5.15, thanks!
--
Thanks,
Sasha
^ permalink raw reply
* Re: [PATCH] HID: usbhid: Use seq_buf_putc() in three functions
From: Markus Elfring @ 2026-06-25 9:55 UTC (permalink / raw)
To: sashiko-reviews, linux-input, linux-usb, Benjamin Tissoires,
Jiri Kosina, Mahad Ibrahim
Cc: Dmitry Torokhov, Woradorn Laodhanadhaworn, LKML, kernel-janitors
In-Reply-To: <20260625093209.34B6B1F000E9@smtp.kernel.org>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Replacing `seq_buf_puts()` with `seq_buf_putc()` introduces a NUL-termination bug when the manufacturer string is exactly 127 bytes long, leading to an out-of-bounds read.
These functions were used without error detection so far.
> --
>
> commit c41669030bdd8635988fc175a1caf4183a28344a
> Author: Markus Elfring <elfring@users.sourceforge.net>
>
> HID: usbhid: Use seq_buf_putc() in three functions
>
> This patch updates three probe functions to use seq_buf_putc() instead
> of seq_buf_puts() when inserting a single space character into sequence
> buffers.
>
>> diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
>> --- a/drivers/hid/usbhid/hid-core.c
>> +++ b/drivers/hid/usbhid/hid-core.c
>> @@ -1412,7 +1412,7 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
>>
>> if (dev->product) {
>> if (dev->manufacturer)
>> - seq_buf_puts(&hid_name, " ");
>> + seq_buf_putc(&hid_name, ' ');
>
> [Severity: Medium]
> Does this change introduce a missing null termination bug in usbhid_probe()
> if the manufacturer string is exactly 127 bytes long?
>
> The previous code using seq_buf_puts() requires two bytes of available
> capacity (one for the space, one for the trailing null byte) and safely fails
> if there isn't enough room.
Can descriptions be extended for possible failure conditions?
https://elixir.bootlin.com/linux/v7.1.1/source/lib/seq_buf.c#L203-L221
> Looking at seq_buf_putc(), it only checks if there is room for one byte.
> If the sequence buffer is exactly 128 bytes long and already contains 127
> characters from dev->manufacturer plus the null terminator, seq_buf_putc()
> will overwrite the null terminator at index 127 with a space character.
>
> This leaves hid->name completely unterminated. When exposed to userspace via
> sysfs or input ioctls, this could lead to an out-of-bounds read into the
> adjacent hid->phys memory field.
>
>> seq_buf_puts(&hid_name, dev->product);
How likely is it that such product information will be appended as expected
at mentioned source code places?
Regards,
Markus
^ permalink raw reply
* [PATCH] HID: usbhid: Use seq_buf_putc() in three functions
From: Markus Elfring @ 2026-06-25 9:22 UTC (permalink / raw)
To: linux-input, linux-usb, Benjamin Tissoires, Jiri Kosina,
Mahad Ibrahim
Cc: LKML, kernel-janitors, Woradorn Laodhanadhaworn
From: Markus Elfring <elfring@users.sourceforge.net>
Date: Thu, 25 Jun 2026 11:11:26 +0200
A single space character should occasionally be put into a sequence buffer.
Thus use the function “seq_buf_putc” in these implementations.
The source code was transformed by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
---
drivers/hid/usbhid/hid-core.c | 2 +-
drivers/hid/usbhid/usbkbd.c | 2 +-
drivers/hid/usbhid/usbmouse.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 96b0181cf819..a755102b8cfe 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1412,7 +1412,7 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
if (dev->product) {
if (dev->manufacturer)
- seq_buf_puts(&hid_name, " ");
+ seq_buf_putc(&hid_name, ' ');
seq_buf_puts(&hid_name, dev->product);
}
diff --git a/drivers/hid/usbhid/usbkbd.c b/drivers/hid/usbhid/usbkbd.c
index 83d4df0d7a45..02abd54eca49 100644
--- a/drivers/hid/usbhid/usbkbd.c
+++ b/drivers/hid/usbhid/usbkbd.c
@@ -302,7 +302,7 @@ static int usb_kbd_probe(struct usb_interface *iface,
if (dev->product) {
if (dev->manufacturer)
- seq_buf_puts(&kbd_name, " ");
+ seq_buf_putc(&kbd_name, ' ');
seq_buf_puts(&kbd_name, dev->product);
}
diff --git a/drivers/hid/usbhid/usbmouse.c b/drivers/hid/usbhid/usbmouse.c
index b3b2abeee614..9fce51d65cd6 100644
--- a/drivers/hid/usbhid/usbmouse.c
+++ b/drivers/hid/usbhid/usbmouse.c
@@ -150,7 +150,7 @@ static int usb_mouse_probe(struct usb_interface *intf, const struct usb_device_i
if (dev->product) {
if (dev->manufacturer)
- seq_buf_puts(&mouse_name, " ");
+ seq_buf_putc(&mouse_name, ' ');
seq_buf_puts(&mouse_name, dev->product);
}
--
2.54.0
^ permalink raw reply related
* [PATCH 2/2] dt-bindings: usb: generic-ohci: Document clock-names in top-level
From: Krzysztof Kozlowski @ 2026-06-25 9:17 UTC (permalink / raw)
To: Greg Kroah-Hartman, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, linux-usb, devicetree, linux-kernel
Cc: Krzysztof Kozlowski
In-Reply-To: <20260625091744.109467-3-krzysztof.kozlowski@oss.qualcomm.com>
Convention is to always have properties defined in top-level part of the
binding and then customized (narrowed per variant) in "if:then:" blocks.
The clock-names were mentioned only in such "if:then:" block for
atmel,at91rm9200-ohci, thus add the top-level part and disallow usage of
clock-names for other devices. This has no practical impact as
clock-names are not used by other variants, except in
hisilicon/hi3798cv200.dtsi, but that SoC has it undocumented.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
---
Documentation/devicetree/bindings/usb/generic-ohci.yaml | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/Documentation/devicetree/bindings/usb/generic-ohci.yaml b/Documentation/devicetree/bindings/usb/generic-ohci.yaml
index d42f448fa204..322808aaa283 100644
--- a/Documentation/devicetree/bindings/usb/generic-ohci.yaml
+++ b/Documentation/devicetree/bindings/usb/generic-ohci.yaml
@@ -83,6 +83,10 @@ properties:
- if a USB DRD channel: first clock should be host and second
one should be peripheral
+ clock-names:
+ minItems: 1
+ maxItems: 4
+
power-domains:
maxItems: 1
@@ -182,6 +186,7 @@ allOf:
else:
properties:
+ clock-names: false
atmel,vbus-gpio: false
atmel,oc-gpio: false
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox