* [PATCH v3] usb: typec: displayport: Reject DP Alt Mode VDO with no pin assignment for its capability
From: madhu.m @ 2026-06-23 0:32 UTC (permalink / raw)
To: gregkh; +Cc: heikki.krogerus, akuchynski, linux-usb, linux-kernel, Madhu M
In-Reply-To: <20260619163109.3529666-1-madhu.m@intel.com>
From: Madhu M <madhu.m@intel.com>
Some docks/Type-C dongles expose a malformed DP Capabilities VDO: they
claim a DFP_D (source) or UFP_D (sink) capability but leave the
corresponding pin assignment field empty. Such a device can never have
Alt Mode configured. Currently the driver still proceeds, which is
misleading and offers no diagnostic.
Per VESA DPAM v2.1a Section 5.4.1 (Table 5-6):
Case 1 (receptacle): A DP Source device receptacle (DFP_D) declares its
lane routing in the DP Source Pin field (Bits 15:8); a DP Sink device
receptacle (UFP_D) declares its lanes in the DP Sink Pin field
(Bits 23:16).
Case 2 (direct-attach plug): A DP Sink device plug (UFP_D) declares its
lane routing in the DP Source Pin field (Bits 15:8), and a DP Source
device plug (DFP_D) declares its lanes in the DP Sink Pin field
(Bits 23:16).
In either case the field holds the supported pin assignment values
(e.g. C/D/E); 00000000b means no pin assignment is supported for that
capability.
Reject such a DP Alt Mode VDO in dp_altmode_probe(): if the claimed
capability has no matching pin assignments, fail probe with -ENODEV,
releasing the SOP' plug reference on the error path.
Signed-off-by: Madhu M <madhu.m@intel.com>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
Changes in v3:
- No functional change. Restore the version changelog below the --- line.
Note: v1 was an internal review (with Heikki) and was never posted to the
list, so v2 was effectively the first public submission.
Changes in v2 (vs internal v1):
- Drop the explicit "if (alt->vdo & DP_CAP_RECEPTACLE)" guard and the
nested block. Use the receptacle-aware DP_CAP_PIN_ASSIGN_DFP_D()/
DP_CAP_PIN_ASSIGN_UFP_D() macros instead of the raw
DP_CAP_DFP_D_PIN_ASSIGN()/DP_CAP_UFP_D_PIN_ASSIGN() ones. They already
apply the Bit 6 (Receptacle Indication) swap, so a single check now
covers both receptacles and direct-attach plugs.
- Return -ENODEV instead of -EOPNOTSUPP, matching the existing
pin-configuration rejection path right above.
- Drop the dev_err() diagnostic line (raw VDO + "DFP_D"/"UFP_D" string).
- Hoist "cap" to a function-scope u32 at the top of dp_altmode_probe()
(was a local u8 inside the receptacle block).
- Reword subject: "usb: typec: altmodes/displayport: validate dp pin
assignments for USB-C receptacles" -> "usb: typec: displayport: Reject
DP Alt Mode VDO with no pin assignment for its capability".
- Rewrite commit body: describe the VESA Table 5-6 pin-field routing for
both receptacles and direct-attach plugs (including the 00000000b
"not supported" encoding).
drivers/usb/typec/altmodes/displayport.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 263a89c5f324..2a553cfcf61d 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -764,6 +764,7 @@ int dp_altmode_probe(struct typec_altmode *alt)
struct typec_altmode *plug = typec_altmode_get_plug(alt, TYPEC_PLUG_SOP_P);
struct fwnode_handle *fwnode;
struct dp_altmode *dp;
+ u32 cap = DP_CAP_CAPABILITY(alt->vdo);
/* Port can only be DFP_U. */
if (typec_altmode_get_data_role(alt) != TYPEC_HOST)
@@ -778,6 +779,18 @@ int dp_altmode_probe(struct typec_altmode *alt)
return -ENODEV;
}
+ /*
+ * Make sure the DisplayPort VDO is valid (VESA DPAM v2.1a, Section
+ * 5.4.1, Table 5-6, DP Capabilities VDO). A device exposing DP on a
+ * USB-C receptacle must advertise at least one pin assignment for the
+ * capability it claims, otherwise Alt Mode can never be configured.
+ */
+ if ((cap == DP_CAP_DFP_D && !DP_CAP_PIN_ASSIGN_DFP_D(alt->vdo)) ||
+ (cap == DP_CAP_UFP_D && !DP_CAP_PIN_ASSIGN_UFP_D(alt->vdo))) {
+ typec_altmode_put_plug(plug);
+ return -ENODEV;
+ }
+
dp = devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL);
if (!dp) {
typec_altmode_put_plug(plug);
--
2.34.1
^ permalink raw reply related
* [PATCH v1] usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
From: Badhri Jagan Sridharan @ 2026-06-22 22:08 UTC (permalink / raw)
To: heikki.krogerus, gregkh, badhri
Cc: amitsd, kyletso, rdbabiera, linux-kernel, linux-usb, stable
In svdm_consume_modes(), the SVID value is read from pmdata->svids using
pmdata->svid_index as an array index without bounds validation:
paltmode->svid = pmdata->svids[pmdata->svid_index];
If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results
in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data
is embedded inside struct tcpm_port, indexing past svids reads into
adjacent fields. In particular:
- At index 16, it reads the altmodes count.
- At index 18 and beyond, it reads into altmode_desc[], which contains
partner-supplied SVDM Discovery Modes VDOs.
By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index
to 20, the partner can force paltmode->svid to be loaded with an arbitrary,
partner- chosen SVID, which is then registered via
typec_partner_register_altmode().
Fix this by validating that pmdata->svid_index is non-negative and strictly
less than pmdata->nsvids before accessing the pmdata->svids array inside
svdm_consume_modes().
Assisted-by: Antigravity:gemini-3.5-flash
Fixes: 4ab8c18d4d67 ("usb: typec: Register a device for every mode")
Cc: stable <stable@kernel.org>
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Reviewed-by: RD Babiera <rdbabiera@google.com>
---
drivers/usb/typec/tcpm/tcpm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 7ef746a90a17..bc531923b1ca 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2000,6 +2000,11 @@ static void svdm_consume_modes(struct tcpm_port *port, const u32 *p, int cnt,
return;
}
+ if (pmdata->svid_index < 0 || pmdata->svid_index >= pmdata->nsvids) {
+ tcpm_log(port, "Invalid SVID index %d", pmdata->svid_index);
+ return;
+ }
+
for (i = 1; i < cnt; i++) {
if (pmdata->altmodes >= ALTMODE_DISCOVERY_MAX) {
/* Already logged in svdm_consume_svids() */
base-commit: 1c2b66a7d7257d2652aa41f9a860ecb96dde27dd
--
2.55.0.rc0.786.g65d90a0328-goog
^ permalink raw reply related
* Re: [PATCH 2/2] dt-bindings: Drop incorrect usage of double '::'
From: Sebastian Reichel @ 2026-06-22 20:37 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Peter Griffin, Alim Akhtar, Michael Turquette,
Stephen Boyd, Brian Masney, Sylwester Nawrocki, Chanwoo Choi,
Sam Protsenko, Rob Clark, Dmitry Baryshkov, Abhinav Kumar,
Jessica Zhang, Sean Paul, Marijn Suijten, David Airlie,
Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Inki Dae, Seung-Woo Kim, Kyungmin Park,
Andi Shyti, Georgi Djakov, Lee Jones, Pavel Machek, Hans Verkuil,
Mauro Carvalho Chehab, Ulf Hansson, Peter Rosin, Vinod Koul,
Neil Armstrong, Linus Walleij, Geert Uytterhoeven, Magnus Damm,
Javier Martinez Canillas, Liam Girdwood, Mark Brown,
Greg Kroah-Hartman, Jiri Slaby, Srinivas Kandagatla,
Bartlomiej Zolnierkiewicz, Rafael J. Wysocki, Daniel Lezcano,
Zhang Rui, Lukasz Luba, Jonathan Marek, Taniya Das, Robert Marko,
Christian Marangi, Stephan Gerhold, Adam Skladowski,
Sireesh Kodali, Barnabas Czeman, Imran Shaik,
Sricharan Ramabadhran, Anusha Rao, Luo Jie, Tomasz Figa,
Chanho Park, Sunyeal Hong, Shin Son, Krishna Manikandan,
Jacek Anaszewski, Jaehoon Chung, Marek Szyprowski, Alina Yu,
Andy Gross, Niklas Söderlund, Wesley Cheng, linux-arm-msm,
devicetree, linux-kernel, linux-arm-kernel, linux-samsung-soc,
linux-clk, dri-devel, freedreno, linux-i2c, linux-pm, linux-leds,
linux-media, linux-mmc, linux-phy, linux-gpio, linux-renesas-soc,
linux-serial, linux-sound, linux-usb
In-Reply-To: <20260622101606.485961-4-krzysztof.kozlowski@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 789 bytes --]
Hi,
On Mon, Jun 22, 2026 at 12:16:08PM +0200, Krzysztof Kozlowski wrote:
> There is no use of double colon '::' in YAML. OTOH, the literal style
> block, e.g. using '|' treats all characters as content [1] therefore
> single use of ':' in descriptions is perfectly fine, whenever '|' is
> used.
>
> Cleanup existing code, so the confusing style won't be re-used in new
> contributions.
>
> Link: https://yaml.org/spec/1.2.2/#literal-style [1]
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
>
> ---
>
> Intention for this patch is to go via Rob's tree.
> ---
[...]
> .../bindings/power/reset/restart-handler.yaml | 8 ++++----
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
[...]
Greetings,
-- Sebastian
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [GIT PULL] USB / Thunderbolt driver changes for 7.2-1
From: pr-tracker-bot @ 2026-06-22 19:59 UTC (permalink / raw)
To: Greg KH; +Cc: Linus Torvalds, Andrew Morton, linux-kernel, linux-usb
In-Reply-To: <ajk6F7wN7SNpW82A@kroah.com>
The pull request you sent on Mon, 22 Jun 2026 15:35:19 +0200:
> git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git tags/usb-7.2-rc1
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/364f4a55c661641c02c86a849f0608d8fc3c0006
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply
* Re: [PATCH] usbip: tools: support SuperSpeed Plus devices
From: Shuah Khan @ 2026-06-22 19:20 UTC (permalink / raw)
To: raoxu, valentina.manea.m; +Cc: shuah, i, linux-usb, linux-kernel
In-Reply-To: <1B3C4D10DA532DC9+20260622100802.377751-1-raoxu@uniontech.com>
On 6/22/26 04:08, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
>
> USB/IP reads a remote device's speed from the server-side sysfs
> "speed" attribute. read_attr_speed() converts the string to
> enum usb_device_speed before the value is sent to the client.
>
> The conversion table only recognizes 5000 Mbps. Devices reporting
> 10000 or 20000 Mbps are therefore sent as USB_SPEED_UNKNOWN. The
> client then selects a USB 2.0 VHCI port, and the kernel rejects the
> attach request because USB_SPEED_UNKNOWN is not a supported speed.
>
> Map both SuperSpeed Plus sysfs values to USB_SPEED_SUPER_PLUS and
> select the SuperSpeed VHCI hub for that speed.
>
> The issue was reproduced with the following server hardware:
>
> xHCI controller: Intel 8086:a0ed, revision 20
> Subsystem: Lenovo 17aa:382a
> USB device: Silicon Motion 090c:2320 mass storage
> sysfs speed: 10000 Mbps
>
> Before the change:
>
> $ usbip attach -r 10.20.12.170 -b 2-2
> usbip: error: import device
>
> After the change, the device attaches and uses usb-storage:
>
> $ usbip port
> Port 08: <Port in Use> at Super Speed(5000Mbps)
> 8-1 -> usbip://10.20.12.170:3240/2-2
>
> VHCI currently exposes the imported device as SuperSpeed, so the
> client reports 5000 Mbps instead of 10000 Mbps. This is a separate
> speed-reporting limitation and does not prevent attachment or I/O.
>
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> ---
> tools/usb/usbip/libsrc/usbip_common.c | 2 ++
> tools/usb/usbip/libsrc/vhci_driver.c | 1 +
> 2 files changed, 3 insertions(+)
>
> diff --git a/tools/usb/usbip/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c
> index b8d7d480595a..d91872a425f5 100644
> --- a/tools/usb/usbip/libsrc/usbip_common.c
> +++ b/tools/usb/usbip/libsrc/usbip_common.c
> @@ -29,6 +29,8 @@ static const struct speed_string speed_strings[] = {
> { USB_SPEED_HIGH, "480", "High Speed(480Mbps)" },
> { USB_SPEED_WIRELESS, "53.3-480", "Wireless"},
> { USB_SPEED_SUPER, "5000", "Super Speed(5000Mbps)" },
> + { USB_SPEED_SUPER_PLUS, "10000", "SuperSpeed Plus" },
> + { USB_SPEED_SUPER_PLUS, "20000", "SuperSpeed Plus" },
These are duplicate strings? Shouldn't they
be unique?
> { 0, NULL, NULL }
> };
>
> diff --git a/tools/usb/usbip/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c
> index 8159fd98680b..4ca3783ee5b7 100644
> --- a/tools/usb/usbip/libsrc/vhci_driver.c
> +++ b/tools/usb/usbip/libsrc/vhci_driver.c
> @@ -338,6 +338,7 @@ int usbip_vhci_get_free_port(uint32_t speed)
>
> switch (speed) {
> case USB_SPEED_SUPER:
> + case USB_SPEED_SUPER_PLUS:
> if (vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
Won't this continue when hub == USB_SPEED_SUPER_PLUS?
Doesn't look right to me.
> continue;
> break;
> --
> 2.50.1
>
thanks,
-- Shuah
^ permalink raw reply
* Re: [PATCH 05/23] powerpc/powermac: fix OF node refcount
From: Bartosz Golaszewski @ 2026-06-22 17:43 UTC (permalink / raw)
To: Madhavan Srinivasan
Cc: brgl, linux-kernel, netdev, linux-arm-msm, linux-sound,
driver-core, devicetree, linuxppc-dev, linux-i2c, iommu, linux-pm,
imx, linux-arm-kernel, intel-xe, dri-devel, linux-usb, linux-mips,
platform-driver-x86, Bartosz Golaszewski, stable, Lee Jones,
Mark Brown, Thierry Reding, Sebastian Hesselbarth, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Srinivas Kandagatla, Greg Kroah-Hartman, Vinod Koul,
Rafael J. Wysocki, Danilo Krummrich, Rob Herring, Saravana Kannan,
Michael Ellerman, Nicholas Piggin, Christophe Leroy (CS GROUP),
Andi Shyti, Andy Shevchenko, Joerg Roedel, Will Deacon,
Robin Murphy, Doug Berger, Florian Fainelli,
Broadcom internal kernel review list, Ulf Hansson, Frank Li,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
Matthew Brost, Thomas Hellström, Rodrigo Vivi, David Airlie,
Simona Vetter, Peter Chen, Paul Cercueil, Bin Liu, Philipp Zabel,
Maximilian Luz, Hans de Goede, Ilpo Järvinen,
Krzysztof Kozlowski, Benjamin Herrenschmidt
In-Reply-To: <20260521-pdev-fwnode-ref-v1-5-88c324a1b8d2@oss.qualcomm.com>
On Thu, 21 May 2026 10:36:28 +0200, Bartosz Golaszewski
<bartosz.golaszewski@oss.qualcomm.com> said:
> Platform devices created with platform_device_alloc() call
> platform_device_release() when the last reference to the device's
> kobject is dropped. This function calls of_node_put() unconditionally.
> This works fine for devices created with platform_device_register_full()
> but users of the split approach (platform_device_alloc() +
> platform_device_add()) must bump the reference of the of_node they
> assign manually. Add the missing call to of_node_get().
>
> Cc: stable@vger.kernel.org
> Fixes: 81e5d8646ff6 ("i2c/powermac: Register i2c devices from device-tree")
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> ---
> arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
> index da72a30ab8657e6dc7e6f3437af612155783d8f9..973f58771d9636605ed5d3e91b45008543b584d3 100644
> --- a/arch/powerpc/platforms/powermac/low_i2c.c
> +++ b/arch/powerpc/platforms/powermac/low_i2c.c
> @@ -1471,7 +1471,7 @@ static int __init pmac_i2c_create_platform_devices(void)
> if (bus->platform_dev == NULL)
> return -ENOMEM;
> bus->platform_dev->dev.platform_data = bus;
> - bus->platform_dev->dev.of_node = bus->busnode;
> + bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
> platform_device_add(bus->platform_dev);
> }
>
>
> --
> 2.47.3
>
>
Madhavan, can you please pick this up and send it upstream as a fix please?
Not having to carry it with the rest of the series will make things easier
for the next release.
Thanks,
Bartosz
^ permalink raw reply
* Re: [PATCH 0/2] tracing: Move trace_printk.h out of kernel.h
From: Steven Rostedt @ 2026-06-22 16:51 UTC (permalink / raw)
To: Randy Dunlap
Cc: Peter Zijlstra, linux-kernel, linux-trace-kernel,
Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Linus Torvalds, Sebastian Andrzej Siewior, John Ogness,
Thomas Gleixner, Julia Lawall, Yury Norov, linux-doc,
linux-kbuild, linuxppc-dev, dri-devel, linux-stm32,
linux-arm-kernel, linux-rdma, linux-usb, linux-ext4, linux-nfs,
kvm, intel-gfx
In-Reply-To: <08b3c961-18bb-43d9-8d7f-8a87bcad0afa@infradead.org>
On Mon, 22 Jun 2026 09:40:45 -0700
Randy Dunlap <rdunlap@infradead.org> wrote:
> > Did you forget your C 101 class? If you use a function, you gotta
> > include the relevant header.
>
> Also item #1 in Documentation/process/submit-checklist.rst.
What is that? Remove all trace_printk()s before you submit?
Because that is what you should do. But now you also need to remember
to remove the include <linux/trace_printk.h> too. Or, I guess if
someone uses it a lot, they may just keep it in their files without the
trace_printk()s.
-- Steve
^ permalink raw reply
* Re: [PATCH 1/2] dt-bindings: clock: Drop incorrect usage of double '::'
From: Conor Dooley @ 2026-06-22 16:50 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Peter Griffin, Alim Akhtar, Michael Turquette,
Stephen Boyd, Brian Masney, Sylwester Nawrocki, Chanwoo Choi,
Sam Protsenko, Rob Clark, Dmitry Baryshkov, Abhinav Kumar,
Jessica Zhang, Sean Paul, Marijn Suijten, David Airlie,
Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Inki Dae, Seung-Woo Kim, Kyungmin Park,
Andi Shyti, Georgi Djakov, Lee Jones, Pavel Machek, Hans Verkuil,
Mauro Carvalho Chehab, Ulf Hansson, Peter Rosin, Vinod Koul,
Neil Armstrong, Linus Walleij, Geert Uytterhoeven, Magnus Damm,
Sebastian Reichel, Javier Martinez Canillas, Liam Girdwood,
Mark Brown, Greg Kroah-Hartman, Jiri Slaby, Srinivas Kandagatla,
Bartlomiej Zolnierkiewicz, Rafael J. Wysocki, Daniel Lezcano,
Zhang Rui, Lukasz Luba, Jonathan Marek, Taniya Das, Robert Marko,
Christian Marangi, Stephan Gerhold, Adam Skladowski,
Sireesh Kodali, Barnabas Czeman, Imran Shaik,
Sricharan Ramabadhran, Anusha Rao, Luo Jie, Tomasz Figa,
Chanho Park, Sunyeal Hong, Shin Son, Krishna Manikandan,
Jacek Anaszewski, Jaehoon Chung, Marek Szyprowski, Alina Yu,
Andy Gross, Niklas Söderlund, Wesley Cheng, linux-arm-msm,
devicetree, linux-kernel, linux-arm-kernel, linux-samsung-soc,
linux-clk, dri-devel, freedreno, linux-i2c, linux-pm, linux-leds,
linux-media, linux-mmc, linux-phy, linux-gpio, linux-renesas-soc,
linux-serial, linux-sound, linux-usb
In-Reply-To: <20260622101606.485961-3-krzysztof.kozlowski@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 583 bytes --]
On Mon, Jun 22, 2026 at 12:16:07PM +0200, Krzysztof Kozlowski wrote:
> There is no use of double colon '::' in YAML. OTOH, the literal style
> block, e.g. using '|' treats all characters as content [1] therefore
> single use of ':' in descriptions is perfectly fine, whenever '|' is
> used.
>
> Cleanup existing code, so the confusing style won't be re-used in new
> contributions.
>
> Link: https://yaml.org/spec/1.2.2/#literal-style [1]
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
* Re: [PATCH 0/2] tracing: Move trace_printk.h out of kernel.h
From: Randy Dunlap @ 2026-06-22 16:40 UTC (permalink / raw)
To: Peter Zijlstra, Steven Rostedt
Cc: linux-kernel, linux-trace-kernel, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Andrew Morton, Linus Torvalds,
Sebastian Andrzej Siewior, John Ogness, Thomas Gleixner,
Julia Lawall, Yury Norov, linux-doc, linux-kbuild, linuxppc-dev,
dri-devel, linux-stm32, linux-arm-kernel, linux-rdma, linux-usb,
linux-ext4, linux-nfs, kvm, intel-gfx
In-Reply-To: <20260622083440.GX49951@noisy.programming.kicks-ass.net>
On 6/22/26 1:34 AM, Peter Zijlstra wrote:
> On Sun, Jun 21, 2026 at 05:34:30AM -0400, Steven Rostedt wrote:
>> There's been complaints about trace_printk() being defined in kernel.h as it
>> can increase the compilation time. As it is only used by some developers for
>> debugging purposes, it should not be in kernel.h causing lots of wasted CPU
>> cycles for those that do not ever care about it.
>>
>> Instead, add a CONFIG_TRACE_PRINTK_DEBUGGING option that developers that do
>> use it can set and not have to always remember to add #include <linux/trace_printk.h>
>> to the files they add trace_printk() while debugging. It also means that
>> those that do not have that config set will not have to worry about wasted
>> CPU cycles as it is only include in the CFLAGS when the option is set, and
>> its completely ignored otherwise.
>
> Did you forget your C 101 class? If you use a function, you gotta
> include the relevant header.
Also item #1 in Documentation/process/submit-checklist.rst.
> You don't see userspace saying: 'Hey, you know what, perhaps we should
> add stdio.h to every other header, just in case someone wants to
> printf()' either.
>
> I really don't understand your argument. Yes, maybe someone will forget
> and then either their editor (if they have a halfway modern setup with
> LSP enabled) or their build will complain, but so what? This is all
> trivial stuff, surely we have more pressing matters to concern outselves
> with?
--
~Randy
^ permalink raw reply
* Re: [PATCH] USB: misc: iowarrior: fix use-after-free in release
From: Johan Hovold @ 2026-06-22 15:49 UTC (permalink / raw)
To: Yue Sun; +Cc: Greg Kroah-Hartman, Oliver Neukum, linux-usb, linux-kernel
In-Reply-To: <20260619150340.65058-1-samsun1006219@gmail.com>
On Fri, Jun 19, 2026 at 11:03:37PM +0800, Yue Sun wrote:
> From: Sam Sun <samsun1006219@gmail.com>
>
> iowarrior_release() clears dev->opened while holding dev->mutex and then
> unlocks the mutex before freeing the device when it has already been
> disconnected. If iowarrior_disconnect() is waiting for the same mutex, it
> can acquire it while mutex_unlock() in release is still in progress,
> observe dev->opened == 0, and free the same object.
The above description is not correct as it seems to suggests that there
is a double-free here, which there is not.
Either release() or disconnect() will free the driver data, but the
other one may still be executing mutex_unlock() when that happens.
> This violates the
> mutex_unlock() lifetime rule because the mutex storage can be freed before
> mutex_unlock() has returned.
Indeed. Thanks for catching this.
> Fix this by adding a kref to struct iowarrior and holding one reference
> for the USB interface, one for each opened file, and one for each
> in-flight asynchronous write URB. Release, disconnect and write completion
> now only drop their references after they are done using the object, and
> the object is freed only after all users have released it.
You only need a reference for each open file (and one while the driver
is bound). All I/O must cease on disconnect so there is no need to keep
an additional reference for each outstanding write.
Note that there is another bug here for which the fix has not yet been
applied though:
https://lore.kernel.org/all/20260523170523.1074563-1-johan@kernel.org/
> Reported-by: Sam Sun <samsun1006219@gmail.com>
You shouldn't add a reported-by tag for issues you fix yourself. A Link
to the syzbot report is good to have though.
> Closes: https://lore.kernel.org/r/20260618080204.38322-1-samsun1006219@gmail.com
I only saw your report last week and missed that you had posted this fix
until today when I was about to submit a series fixing this driver and a
few others that got this wrong:
https://lore.kernel.org/all/20260622152612.116422-1-johan@kernel.org/
With the commit message fixed and the write references dropped they are
mostly equivalent.
> Signed-off-by: Sam Sun <samsun1006219@gmail.com>
> ---
> @@ -95,6 +97,10 @@ struct iowarrior {
> struct usb_anchor submitted;
> };
>
> +#define to_iowarrior_dev(d) container_of(d, struct iowarrior, kref)
I know we have a few of these in the tree already, but it's not really
needed for a single user and the "d" is a bit misleading as these macros
are typically used to cast from a struct device (not a kref).
> +
> +static void iowarrior_delete(struct kref *kref);
> +
> /*--------------*/
> /* globals */
> /*--------------*/
> @@ -235,13 +241,16 @@ static void iowarrior_write_callback(struct urb *urb)
> /* tell a waiting writer the interrupt-out-pipe is available again */
> atomic_dec(&dev->write_busy);
> wake_up_interruptible(&dev->write_wait);
> + kref_put(&dev->kref, iowarrior_delete);
> }
> @@ -454,12 +463,14 @@ static ssize_t iowarrior_write(struct file *file,
> goto error;
> }
> usb_anchor_urb(int_out_urb, &dev->submitted);
> + kref_get(&dev->kref);
> retval = usb_submit_urb(int_out_urb, GFP_KERNEL);
> if (retval) {
> dev_dbg(&dev->interface->dev,
> "submit error %d for urb nr.%d\n",
> retval, atomic_read(&dev->write_busy));
> usb_unanchor_urb(int_out_urb);
> + kref_put(&dev->kref, iowarrior_delete);
> goto error;
> }
> /* submit was ok */
All outstanding writes should be stopped on disconnect (and soon will be
when the fix I mentioned above is merged), so this is not needed.
> @@ -637,6 +648,7 @@ static int iowarrior_open(struct inode *inode, struct file *file)
> }
> /* increment our usage count for the driver */
> ++dev->opened;
> + kref_get(&dev->kref);
> /* save our object in the file's private structure */
> file->private_data = dev;
> retval = 0;
> @@ -657,13 +669,13 @@ static int iowarrior_release(struct inode *inode, struct file *file)
> dev = file->private_data;
> if (!dev)
> return -ENODEV;
> + file->private_data = NULL;
This looks like an unrelated change.
> /* lock our device */
> mutex_lock(&dev->mutex);
>
> if (dev->opened <= 0) {
> retval = -ENODEV; /* close called more than once */
> - mutex_unlock(&dev->mutex);
> } else {
> dev->opened = 0; /* we're closing now */
> retval = 0;
> @@ -918,8 +929,8 @@ static void iowarrior_disconnect(struct usb_interface *interface)
> } else {
> /* no process is using the device, cleanup now */
> mutex_unlock(&dev->mutex);
> - iowarrior_delete(dev);
> }
The unlock should now be moved after the conditional.
> + kref_put(&dev->kref, iowarrior_delete);
> }
>
> /* usb specific object needed to register this driver with the usb subsystem */
Johan
^ permalink raw reply
* Re: [PATCH RFT RFC] usb: xhci: Kill hosts with HCE or HSE on command timeout
From: Desnes Nunes @ 2026-06-22 15:48 UTC (permalink / raw)
To: Baolu Lu
Cc: Michal Pecio, David Woodhouse, linux-kernel, linux-usb, gregkh,
mathias.nyman, stable, iommu
In-Reply-To: <e9472b38-4a91-44b5-b75e-dc7abd23793d@linux.intel.com>
Hello Baolu,
> >> To IOMMU maintainers: should I send this patch to the iommu mailing
> >> list and move the discussion there?
>
> Yes, absolutely. The iommu mailing list is the right place to discuss
> bugs and fixes, so please go ahead.
>
> > I meant as a new submission to IOMMU maling list, since this started
> > in xHCI at the usb mailing list.
> > Of course, that is if nobody has any comments or objections to the patch.
Sure, just submitted this RFC as a new submission in the IOMMU mailing list.
Thanks Michal and Baolu,
Desnes
^ permalink raw reply
* [PATCH v2] usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure
From: Pengpeng Hou @ 2026-06-22 15:32 UTC (permalink / raw)
To: Pengyu Luo, Heikki Krogerus, Greg Kroah-Hartman
Cc: linux-usb, linux-kernel, pengpeng
gaokun_ucsi_register_worker() registers the EC notifier before calling
ucsi_register(). If ucsi_register() fails, the worker currently only logs
the error and leaves the notifier registered. Later EC events can then
call into an unpublished UCSI instance. The remove path also
unconditionally unregisters the notifier and UCSI device even if the
delayed worker failed before both were published.
Unregister the notifier immediately when ucsi_register() fails, and track
only the fully published state. The remove path then tears down the pair
only if both publication steps completed.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1:
- Drop the two-flag bookkeeping objected to by Greg Kroah-Hartman.
- Keep the existing registration order, but use a single flag that is set
only after both the notifier and UCSI device are published.
- Unregister the EC notifier immediately if ucsi_register() fails.
- Compile-tested only; no Gaokun hardware was available.
drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
index ca749fde49bd..0dcbbff5f205 100644
--- a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
+++ b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
@@ -98,6 +98,7 @@ struct gaokun_ucsi {
struct device *dev;
struct delayed_work work;
struct notifier_block nb;
+ bool registered;
u16 version;
u8 num_ports;
};
@@ -457,8 +458,12 @@ static void gaokun_ucsi_register_worker(struct work_struct *work)
}
ret = ucsi_register(ucsi);
- if (ret)
+ if (ret) {
dev_err_probe(ucsi->dev, ret, "ucsi register failed\n");
+ gaokun_ec_unregister_notify(uec->ec, &uec->nb);
+ return;
+ }
+ uec->registered = true;
}
static int gaokun_ucsi_probe(struct auxiliary_device *adev,
@@ -504,8 +509,10 @@ static void gaokun_ucsi_remove(struct auxiliary_device *adev)
struct gaokun_ucsi *uec = auxiliary_get_drvdata(adev);
disable_delayed_work_sync(&uec->work);
- gaokun_ec_unregister_notify(uec->ec, &uec->nb);
- ucsi_unregister(uec->ucsi);
+ if (uec->registered) {
+ gaokun_ec_unregister_notify(uec->ec, &uec->nb);
+ ucsi_unregister(uec->ucsi);
+ }
ucsi_destroy(uec->ucsi);
}
--
2.50.1
^ permalink raw reply related
* [PATCH 4/4] USB: legousbtower: fix use-after-free on disconnect race
From: Johan Hovold @ 2026-06-22 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Juergen Stuber, Yue Sun, linux-usb, linux-kernel, Johan Hovold,
stable, Daniel Walker
In-Reply-To: <20260622152612.116422-1-johan@kernel.org>
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 18bcbcfe9ca2 ("USB: misc: legousbtower: semaphore to mutex")
Cc: stable@vger.kernel.org # 2.6.25
Cc: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++----------------
1 file changed, 19 insertions(+), 18 deletions(-)
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index 052ffc2e71ee..18dd4115befb 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -185,6 +185,7 @@ MODULE_DEVICE_TABLE(usb, tower_table);
/* Structure to hold all of our device specific stuff */
struct lego_usb_tower {
+ struct kref kref;
struct mutex lock; /* locks this structure */
struct usb_device *udev; /* save off the usb device pointer */
unsigned char minor; /* the starting minor number for this device */
@@ -220,7 +221,6 @@ struct lego_usb_tower {
/* local function prototypes */
static ssize_t tower_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos);
static ssize_t tower_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos);
-static inline void tower_delete(struct lego_usb_tower *dev);
static int tower_open(struct inode *inode, struct file *file);
static int tower_release(struct inode *inode, struct file *file);
static __poll_t tower_poll(struct file *file, poll_table *wait);
@@ -286,8 +286,10 @@ static inline void lego_usb_tower_debug_data(struct device *dev,
/*
* tower_delete
*/
-static inline void tower_delete(struct lego_usb_tower *dev)
+static inline void tower_delete(struct kref *kref)
{
+ struct lego_usb_tower *dev = container_of(kref, struct lego_usb_tower, kref);
+
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -381,6 +383,8 @@ static int tower_open(struct inode *inode, struct file *file)
dev->open_count = 1;
+ kref_get(&dev->kref);
+
unlock_exit:
mutex_unlock(&dev->lock);
@@ -404,14 +408,8 @@ static int tower_release(struct inode *inode, struct file *file)
mutex_lock(&dev->lock);
- if (dev->disconnected) {
- /* the device was unplugged before the file was released */
-
- /* unlock here as tower_delete frees dev */
- mutex_unlock(&dev->lock);
- tower_delete(dev);
- goto exit;
- }
+ if (dev->disconnected)
+ goto out_unlock;
/* wait until write transfer is finished */
if (dev->interrupt_out_busy) {
@@ -425,7 +423,9 @@ static int tower_release(struct inode *inode, struct file *file)
dev->open_count = 0;
+out_unlock:
mutex_unlock(&dev->lock);
+ kref_put(&dev->kref, tower_delete);
exit:
return retval;
}
@@ -752,6 +752,7 @@ static int tower_probe(struct usb_interface *interface, const struct usb_device_
if (!dev)
goto exit;
+ kref_init(&dev->kref);
mutex_init(&dev->lock);
dev->udev = usb_get_dev(udev);
spin_lock_init(&dev->read_buffer_lock);
@@ -828,7 +829,7 @@ static int tower_probe(struct usb_interface *interface, const struct usb_device_
return retval;
error:
- tower_delete(dev);
+ kref_put(&dev->kref, tower_delete);
return retval;
}
@@ -856,18 +857,18 @@ static void tower_disconnect(struct usb_interface *interface)
mutex_lock(&dev->lock);
- /* if the device is not opened, then we clean up right now */
- if (!dev->open_count) {
- mutex_unlock(&dev->lock);
- tower_delete(dev);
- } else {
- dev->disconnected = 1;
+ dev->disconnected = 1;
+
+ if (dev->open_count) {
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
- mutex_unlock(&dev->lock);
}
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, tower_delete);
+
dev_info(&interface->dev, "LEGO USB Tower #%d now disconnected\n",
(minor - LEGO_USB_TOWER_MINOR_BASE));
}
--
2.53.0
^ permalink raw reply related
* [PATCH 1/4] USB: iowarrior: fix use-after-free on disconnect race
From: Johan Hovold @ 2026-06-22 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Juergen Stuber, Yue Sun, linux-usb, linux-kernel, Johan Hovold,
stable
In-Reply-To: <20260622152612.116422-1-johan@kernel.org>
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Cc: stable@vger.kernel.org # 2.6.21
Reported-by: Yue Sun <samsun1006219@gmail.com>
Link: https://lore.kernel.org/r/20260618080204.38322-1-samsun1006219@gmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/iowarrior.c | 57 +++++++++++++++---------------------
1 file changed, 24 insertions(+), 33 deletions(-)
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 88c6d1d1da11..de2b236ef903 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -72,6 +72,7 @@ static struct usb_driver iowarrior_driver;
/* Structure to hold all of our device specific stuff */
struct iowarrior {
+ struct kref kref;
struct mutex mutex; /* locks this structure */
struct usb_device *udev; /* save off the usb device pointer */
struct usb_interface *interface; /* the interface for this device */
@@ -240,8 +241,10 @@ static void iowarrior_write_callback(struct urb *urb)
/*
* iowarrior_delete
*/
-static inline void iowarrior_delete(struct iowarrior *dev)
+static inline void iowarrior_delete(struct kref *kref)
{
+ struct iowarrior *dev = container_of(kref, struct iowarrior, kref);
+
kfree(dev->int_in_buffer);
usb_free_urb(dev->int_in_urb);
kfree(dev->read_queue);
@@ -637,6 +640,9 @@ static int iowarrior_open(struct inode *inode, struct file *file)
}
/* increment our usage count for the driver */
++dev->opened;
+
+ kref_get(&dev->kref);
+
/* save our object in the file's private structure */
file->private_data = dev;
retval = 0;
@@ -652,7 +658,6 @@ static int iowarrior_open(struct inode *inode, struct file *file)
static int iowarrior_release(struct inode *inode, struct file *file)
{
struct iowarrior *dev;
- int retval = 0;
dev = file->private_data;
if (!dev)
@@ -660,29 +665,18 @@ static int iowarrior_release(struct inode *inode, struct file *file)
/* lock our device */
mutex_lock(&dev->mutex);
+ dev->opened = 0; /* we're closing now */
- if (dev->opened <= 0) {
- retval = -ENODEV; /* close called more than once */
- mutex_unlock(&dev->mutex);
- } else {
- dev->opened = 0; /* we're closing now */
- retval = 0;
- if (dev->present) {
- /*
- The device is still connected so we only shutdown
- pending read-/write-ops.
- */
- usb_kill_urb(dev->int_in_urb);
- wake_up_interruptible(&dev->read_wait);
- wake_up_interruptible(&dev->write_wait);
- mutex_unlock(&dev->mutex);
- } else {
- /* The device was unplugged, cleanup resources */
- mutex_unlock(&dev->mutex);
- iowarrior_delete(dev);
- }
+ if (dev->present) {
+ usb_kill_urb(dev->int_in_urb);
+ wake_up_interruptible(&dev->read_wait);
+ wake_up_interruptible(&dev->write_wait);
}
- return retval;
+ mutex_unlock(&dev->mutex);
+
+ kref_put(&dev->kref, iowarrior_delete);
+
+ return 0;
}
static __poll_t iowarrior_poll(struct file *file, poll_table * wait)
@@ -767,6 +761,7 @@ static int iowarrior_probe(struct usb_interface *interface,
if (!dev)
return retval;
+ kref_init(&dev->kref);
mutex_init(&dev->mutex);
atomic_set(&dev->intr_idx, 0);
@@ -885,7 +880,8 @@ static int iowarrior_probe(struct usb_interface *interface,
return retval;
error:
- iowarrior_delete(dev);
+ kref_put(&dev->kref, iowarrior_delete);
+
return retval;
}
@@ -909,19 +905,14 @@ static void iowarrior_disconnect(struct usb_interface *interface)
usb_kill_anchored_urbs(&dev->submitted);
if (dev->opened) {
- /* There is a process that holds a filedescriptor to the device ,
- so we only shutdown read-/write-ops going on.
- Deleting the device is postponed until close() was called.
- */
usb_kill_urb(dev->int_in_urb);
wake_up_interruptible(&dev->read_wait);
wake_up_interruptible(&dev->write_wait);
- mutex_unlock(&dev->mutex);
- } else {
- /* no process is using the device, cleanup now */
- mutex_unlock(&dev->mutex);
- iowarrior_delete(dev);
}
+
+ mutex_unlock(&dev->mutex);
+
+ kref_put(&dev->kref, iowarrior_delete);
}
/* usb specific object needed to register this driver with the usb subsystem */
--
2.53.0
^ permalink raw reply related
* [PATCH 3/4] USB: ldusb: fix use-after-free on disconnect race
From: Johan Hovold @ 2026-06-22 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Juergen Stuber, Yue Sun, linux-usb, linux-kernel, Johan Hovold,
stable, Daniel Walker
In-Reply-To: <20260622152612.116422-1-johan@kernel.org>
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: ce0d7d3f575f ("usb: ldusb: ld_usb semaphore to mutex")
Cc: stable@vger.kernel.org # 2.6.26
Cc: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/ldusb.c | 38 ++++++++++++++++++--------------------
1 file changed, 18 insertions(+), 20 deletions(-)
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index c74f142f6637..71132a15e771 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -150,6 +150,7 @@ MODULE_PARM_DESC(min_interrupt_out_interval, "Minimum interrupt out interval in
/* Structure to hold all of our device specific stuff */
struct ld_usb {
+ struct kref kref;
struct mutex mutex; /* locks this structure */
struct usb_interface *intf; /* save off the usb interface pointer */
unsigned long disconnected:1;
@@ -201,8 +202,10 @@ static void ld_usb_abort_transfers(struct ld_usb *dev)
/*
* ld_usb_delete
*/
-static void ld_usb_delete(struct ld_usb *dev)
+static void ld_usb_delete(struct kref *kref)
{
+ struct ld_usb *dev = container_of(kref, struct ld_usb, kref);
+
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -355,6 +358,8 @@ static int ld_usb_open(struct inode *inode, struct file *file)
goto unlock_exit;
}
+ kref_get(&dev->kref);
+
/* save device in the file's private structure */
file->private_data = dev;
@@ -381,17 +386,8 @@ static int ld_usb_release(struct inode *inode, struct file *file)
mutex_lock(&dev->mutex);
- if (dev->open_count != 1) {
- retval = -ENODEV;
+ if (dev->disconnected)
goto unlock_exit;
- }
- if (dev->disconnected) {
- /* the device was unplugged before the file was released */
- mutex_unlock(&dev->mutex);
- /* unlock here as ld_usb_delete frees dev */
- ld_usb_delete(dev);
- goto exit;
- }
/* wait until write transfer is finished */
if (dev->interrupt_out_busy)
@@ -401,7 +397,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
unlock_exit:
mutex_unlock(&dev->mutex);
-
+ kref_put(&dev->kref, ld_usb_delete);
exit:
return retval;
}
@@ -659,6 +655,8 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
dev = kzalloc_obj(*dev);
if (!dev)
goto exit;
+
+ kref_init(&dev->kref);
mutex_init(&dev->mutex);
spin_lock_init(&dev->rbsl);
dev->intf = intf;
@@ -740,7 +738,7 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
return retval;
error:
- ld_usb_delete(dev);
+ kref_put(&dev->kref, ld_usb_delete);
return retval;
}
@@ -768,18 +766,18 @@ static void ld_usb_disconnect(struct usb_interface *intf)
mutex_lock(&dev->mutex);
- /* if the device is not opened, then we clean up right now */
- if (!dev->open_count) {
- mutex_unlock(&dev->mutex);
- ld_usb_delete(dev);
- } else {
- dev->disconnected = 1;
+ dev->disconnected = 1;
+
+ if (dev->open_count) {
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
- mutex_unlock(&dev->mutex);
}
+ mutex_unlock(&dev->mutex);
+
+ kref_put(&dev->kref, ld_usb_delete);
+
dev_info(&intf->dev, "LD USB Device #%d now disconnected\n",
(minor - USB_LD_MINOR_BASE));
}
--
2.53.0
^ permalink raw reply related
* [PATCH 2/4] USB: idmouse: fix use-after-free on disconnect race
From: Johan Hovold @ 2026-06-22 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Juergen Stuber, Yue Sun, linux-usb, linux-kernel, Johan Hovold,
stable, Oliver Neukum
In-Reply-To: <20260622152612.116422-1-johan@kernel.org>
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 54d2bc068fd2 ("USB: fix locking in idmouse")
Cc: stable@vger.kernel.org # 2.6.24
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/misc/idmouse.c | 45 +++++++++++++++++++-------------------
1 file changed, 22 insertions(+), 23 deletions(-)
diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index 0f6b3464c2d6..3e37adf2bb57 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -63,6 +63,7 @@ MODULE_DEVICE_TABLE(usb, idmouse_table);
/* structure to hold all of our device specific stuff */
struct usb_idmouse {
+ struct kref kref;
struct usb_device *udev; /* save off the usb device pointer */
struct usb_interface *interface; /* the interface for this device */
@@ -209,8 +210,10 @@ static int idmouse_resume(struct usb_interface *intf)
return 0;
}
-static inline void idmouse_delete(struct usb_idmouse *dev)
+static inline void idmouse_delete(struct kref *kref)
{
+ struct usb_idmouse *dev = container_of(kref, struct usb_idmouse, kref);
+
kfree(dev->bulk_in_buffer);
kfree(dev);
}
@@ -254,6 +257,8 @@ static int idmouse_open(struct inode *inode, struct file *file)
/* increment our usage count for the driver */
++dev->open;
+ kref_get(&dev->kref);
+
/* save our object in the file's private structure */
file->private_data = dev;
@@ -277,16 +282,11 @@ static int idmouse_release(struct inode *inode, struct file *file)
/* lock our device */
mutex_lock(&dev->lock);
-
--dev->open;
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, idmouse_delete);
- if (!dev->present) {
- /* the device was unplugged before the file was released */
- mutex_unlock(&dev->lock);
- idmouse_delete(dev);
- } else {
- mutex_unlock(&dev->lock);
- }
return 0;
}
@@ -334,6 +334,7 @@ static int idmouse_probe(struct usb_interface *interface,
if (dev == NULL)
return -ENOMEM;
+ kref_init(&dev->kref);
mutex_init(&dev->lock);
dev->udev = udev;
dev->interface = interface;
@@ -342,8 +343,7 @@ static int idmouse_probe(struct usb_interface *interface,
result = usb_find_bulk_in_endpoint(iface_desc, &endpoint);
if (result) {
dev_err(&interface->dev, "Unable to find bulk-in endpoint.\n");
- idmouse_delete(dev);
- return result;
+ goto err_put_kref;
}
dev->orig_bi_size = usb_endpoint_maxp(endpoint);
@@ -351,8 +351,8 @@ static int idmouse_probe(struct usb_interface *interface,
dev->bulk_in_endpointAddr = endpoint->bEndpointAddress;
dev->bulk_in_buffer = kmalloc(IMGSIZE + dev->bulk_in_size, GFP_KERNEL);
if (!dev->bulk_in_buffer) {
- idmouse_delete(dev);
- return -ENOMEM;
+ result = -ENOMEM;
+ goto err_put_kref;
}
/* allow device read, write and ioctl */
@@ -364,14 +364,18 @@ static int idmouse_probe(struct usb_interface *interface,
if (result) {
/* something prevented us from registering this device */
dev_err(&interface->dev, "Unable to allocate minor number.\n");
- idmouse_delete(dev);
- return result;
+ goto err_put_kref;
}
/* be noisy */
dev_info(&interface->dev,"%s now attached\n",DRIVER_DESC);
return 0;
+
+err_put_kref:
+ kref_put(&dev->kref, idmouse_delete);
+
+ return result;
}
static void idmouse_disconnect(struct usb_interface *interface)
@@ -387,14 +391,9 @@ static void idmouse_disconnect(struct usb_interface *interface)
/* prevent device read, write and ioctl */
dev->present = 0;
- /* if the device is opened, idmouse_release will clean this up */
- if (!dev->open) {
- mutex_unlock(&dev->lock);
- idmouse_delete(dev);
- } else {
- /* unlock */
- mutex_unlock(&dev->lock);
- }
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, idmouse_delete);
dev_info(&interface->dev, "disconnected\n");
}
--
2.53.0
^ permalink raw reply related
* [PATCH 0/4] USB: fix use-after-free on disconnect race
From: Johan Hovold @ 2026-06-22 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Juergen Stuber, Yue Sun, linux-usb, linux-kernel, Johan Hovold
Mutexes cannot be used to manage lifetime of objects directly as the
mutex structure is accessed by mutex_unlock() after releasing the lock.
Note that the reporter of the iowarrior issue sent a fix last Friday
that I had missed. That one requires a bit of work still, though. [1]
Johan
[1] https://lore.kernel.org/all/20260619150340.65058-1-samsun1006219@gmail.com/
Johan Hovold (4):
USB: iowarrior: fix use-after-free on disconnect race
USB: idmouse: fix use-after-free on disconnect race
USB: ldusb: fix use-after-free on disconnect race
USB: legousbtower: fix use-after-free on disconnect race
drivers/usb/misc/idmouse.c | 45 +++++++++++++-------------
drivers/usb/misc/iowarrior.c | 57 ++++++++++++++-------------------
drivers/usb/misc/ldusb.c | 38 +++++++++++-----------
drivers/usb/misc/legousbtower.c | 37 ++++++++++-----------
4 files changed, 83 insertions(+), 94 deletions(-)
--
2.53.0
^ permalink raw reply
* [PATCH] usb: gadget: fsl_qe_udc: fix gadget lifetime on registration failure
From: Haoxiang Li @ 2026-06-22 14:06 UTC (permalink / raw)
To: gregkh, kees, balbi, sebastian
Cc: linux-usb, linuxppc-dev, linux-kernel, Haoxiang Li, stable
usb_add_gadget_udc_release() drops the gadget device reference when
registration fails. This invokes qe_udc_release() while qe_udc_probe()
is still unwinding. Since udc->done is not initialized during probe,
the release callback dereferences NULL in complete(). It also frees
the qe_udc object before the remaining probe cleanup accesses it,
resulting in use-after-free and double-free risks.
Initialize the gadget device explicitly and register it with
usb_add_gadget(), which leaves the gadget reference owned by the
driver on failure. Unwind the IRQ, DMA mappings, endpoint resources
and registers before dropping that reference with usb_put_gadget().
Make the completion notification conditional because it is only
installed by the remove path.
Similarly, use usb_del_gadget() during removal so the final gadget
reference remains held while the controller resources are released.
Set the completion pointer immediately before dropping the reference,
then wait for the release callback to finish.
Fixes: d77c1198666d ("usb: gadget: fsl_qe_udc: convert to new style start/stop")
Cc: stable@kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
drivers/usb/gadget/udc/fsl_qe_udc.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index bf87285ad13c..f9a59b32e272 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -2459,7 +2459,9 @@ static void qe_udc_release(struct device *dev)
struct qe_udc *udc = container_of(dev, struct qe_udc, gadget.dev);
int i;
- complete(udc->done);
+ if (udc->done)
+ complete(udc->done);
+
cpm_muram_free(cpm_muram_offset(udc->ep_param[0]));
for (i = 0; i < USB_MAX_ENDPOINTS; i++)
udc->ep_param[i] = NULL;
@@ -2489,6 +2491,9 @@ static int qe_udc_probe(struct platform_device *ofdev)
return -ENOMEM;
}
+ usb_initialize_gadget(&ofdev->dev, &udc->gadget,
+ qe_udc_release);
+
udc->soc_type = (unsigned long)device_get_match_data(&ofdev->dev);
udc->usb_regs = of_iomap(np, 0);
if (!udc->usb_regs) {
@@ -2575,8 +2580,7 @@ static int qe_udc_probe(struct platform_device *ofdev)
goto err4;
}
- ret = usb_add_gadget_udc_release(&ofdev->dev, &udc->gadget,
- qe_udc_release);
+ ret = usb_add_gadget(&udc->gadget);
if (ret)
goto err5;
@@ -2610,7 +2614,7 @@ static int qe_udc_probe(struct platform_device *ofdev)
err2:
iounmap(udc->usb_regs);
err1:
- kfree(udc);
+ usb_put_gadget(&udc->gadget);
return ret;
}
@@ -2633,9 +2637,8 @@ static void qe_udc_remove(struct platform_device *ofdev)
unsigned int size;
DECLARE_COMPLETION_ONSTACK(done);
- usb_del_gadget_udc(&udc->gadget);
+ usb_del_gadget(&udc->gadget);
- udc->done = &done;
tasklet_disable(&udc->rx_tasklet);
if (udc->nullmap) {
@@ -2675,6 +2678,8 @@ static void qe_udc_remove(struct platform_device *ofdev)
iounmap(udc->usb_regs);
+ udc->done = &done;
+ usb_put_gadget(&udc->gadget);
/* wait for release() of gadget.dev to free udc */
wait_for_completion(&done);
}
--
2.25.1
^ permalink raw reply related
* [GIT PULL] USB / Thunderbolt driver changes for 7.2-1
From: Greg KH @ 2026-06-22 13:35 UTC (permalink / raw)
To: Linus Torvalds; +Cc: Andrew Morton, linux-kernel, linux-usb
The following changes since commit e43ffb69e0438cddd72aaa30898b4dc446f664f8:
Linux 7.1-rc6 (2026-05-31 15:14:24 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git tags/usb-7.2-rc1
for you to fetch changes up to 1c2b66a7d7257d2652aa41f9a860ecb96dde27dd:
usb: ucsi: huawei_gaokun: support mode switching (2026-06-12 18:04:07 +0200)
----------------------------------------------------------------
USB/Thunderbolt driver changes for 7.2-rc1
Here is the big set of USB and Thunderbolt driver changes for 7.2-rc1.
Lots of little stuff in here, major highlights include:
- USB4STREAM support for Thunderbolt devices. A new way to send "raw"
data very quickly over a USB4 connection to another system directly.
- Other thunderbolt updates and changes to make the stream code work
- xhci driver updates and additions
- typec driver updates and additions
- usb gadget driver updates and fixes for reported issues
- zh_CN documentation translation of the USB documentation
- usb-serial driver updates
- dts cleanups for some USB platforms
- other minor USB driver updates and tweaks
All of these have been in linux-next for over a week with no reported
issues, most of them for many many weeks.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----------------------------------------------------------------
Adrian Wowk (2):
usbip: vhci_hcd: fix NULL deref in status_show_vhci
usbip: vhci_hcd: reduce CONFIG_USBIP_VHCI_NR_HCS upper bound to 32
Akash Sukhavasi (1):
dt-bindings: usb: richtek,rt1711h: remove deprecated .txt file
Alan Borzeszkowski (2):
thunderbolt: Don't create multiple DMA tunnels on firmware connection manager
thunderbolt: Improve multi-display DisplayPort tunnel allocation
Antony Kurniawan Soemardi (1):
dt-bindings: usb: ci-hdrc-usb2: allow up to 3 clocks for qcom,ci-hdrc
Arnd Bergmann (1):
usb: udc: pxa: remove unused platform_data
Christian Marangi (1):
usb: host: add ARCH_AIROHA in XHCI MTK dependency
Dave Carey (1):
USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
Dmitry Baryshkov (6):
dt-bindings: usb: qcom,pmic-typec: deprecate device-specific VBUS
usb: typec: tcpm: qcom: prefer VBUS supply from the connector node
arm64: dts: qcom: pm4125: move vdd-vbus-supply to connector nodes
arm64: dts: qcom: pm7250b: move vdd-vbus-supply to connector nodes
arm64: dts: qcom: pm8150b: move vdd-vbus-supply to connector nodes
arm64: dts: qcom: pmi632: move vdd-vbus-supply to connector nodes
Geert Uytterhoeven (2):
usb: host: xhci-rcar: Remove SET_XHCI_PLAT_PRIV_FOR_RCAR() macro
usb: host: xhci-rcar: Split R-Car Gen2 and Gen3 .plat_start() handling
Gil Fine (7):
thunderbolt: Avoid reserved fields in path config space for USB4 routers
thunderbolt: Fix lane bonding log when bonding not possible
thunderbolt: Activate path hops from source to destination
thunderbolt: Verify PCIe adapter in detect state before tunnel setup
thunderbolt: Verify Router Ready bit is set after router enumeration
thunderbolt: Increase timeout for Configuration Ready bit
thunderbolt: Increase Notification Timeout to 255 ms for USB4 routers
Greg Kroah-Hartman (4):
Merge tag 'v7.1-rc3' into usb-next
Merge tag 'v7.1-rc6' into usb-next
Merge tag 'thunderbolt-for-v7.2-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next
Merge tag 'usb-serial-7.2-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next
Hans Zhang (6):
usb: dwc3: Use FIELD_MODIFY()
usb: dwc3: google: Use FIELD_MODIFY()
usb: dwc3: dwc3-octeon: Use FIELD_MODIFY()
usb: xhci: Use FIELD_MODIFY()
usb: xhci-mtk: Use FIELD_MODIFY()
usb: typec: Use FIELD_MODIFY()
Jihong Min (2):
usb: xhci-pci: add AMD Promontory 21 PCI glue
hwmon: add AMD Promontory 21 xHCI temperature sensor support
Jisheng Zhang (1):
usb: dwc2: remove WARN in dwc2_hcd_save_data_toggle
Johan Hovold (9):
USB: serial: mxuport: update number-of-ports encoding
USB: serial: drop unused tty_driver includes
USB: serial: drop unused tty_flip includes
USB: serial: xr: add missing uaccess include
USB: serial: drop unused uaccess includes
USB: serial: drop unused moduleparam includes
USB: serial: garmin_gps: drop unused atomic include
USB: serial: add missing atomic includes
USB: serial: whiteheat: drop termbits include
Jonas Karlman (1):
dt-bindings: usb: dwc3: Add compatible for RK3528
Kefan Bai (8):
docs/zh_CN: Add index.rst translation
docs/zh_CN: Add acm.rst translation
docs/zh_CN: Add authorization.rst translation
docs/zh_CN: Add chipidea.rst translation
docs/zh_CN: Add dwc3.rst translation
docs/zh_CN: Add ehci.rst translation
docs/zh_CN: Add usbmon.rst translation
docs/zh_CN: Add CREDITS translation
Konrad Dybcio (6):
thunderbolt: debugfs: Don't stop reading SB registers if just one fails
usb: typec: mux: ps883x: Power the retimer off when not in use
thunderbolt: Move pci_device out of tb_nhi
thunderbolt: Separate out common NHI bits
thunderbolt: Require nhi->ops be valid
thunderbolt: Add some more descriptive probe error messages
Krzysztof Kozlowski (3):
USB: qcom: Unify user-visible "Qualcomm" name
dt-bindings: usb: qcom,pmic-typec: Drop redundant port
USB: typec: qcom-pmic-typec: Drop redundant header includes
Maoyi Xie (1):
usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
Mathias Nyman (6):
xhci: dbc: Fix sysfs ABI Documentation for xhci dbc states
xhci: dbc: serialize enabling and disabling dbc
xhci: dbc: add helper to set and clear DbC DCE enable bit
xhci: dbc: add timestamps to DbC state changes in a new helper.
xhci: dbc: detect and recover hung DbC during enumeraton
xhci: Prevent queuing new commands if xhci is inaccessible
Mauricio Faria de Oliveira (2):
usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
usb: atm: ueagle-atm: remove function entry/exit debug messages
Michael Bommarito (3):
thunderbolt: test: add KUnit regression tests for XDomain property parser
thunderbolt: test: Add KUnit tests for property parser bounds checks
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Michal Pecio (4):
usb: xhci: Simplify xhci_quiesce()
usb: xhci: Remove skip_isoc_td()
usb: xhci: Remove isochronous URB_SHORT_NOT_OK handling
usb: xhci: Improve Soft Retries after short transfers
Mika Westerberg (20):
thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible
thunderbolt: Make XDomain lane bonding comply with the USB4 v2 spec
thunderbolt: Keep the domain reference while processing hotplug
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
thunderbolt: Set tb->root_switch to NULL when domain is stopped
thunderbolt: Wait for tb_domain_release() to complete when driver is removed
thunderbolt: Keep XDomain reference during the lifetime of a service
thunderbolt: dma_test: No need to store debugfs directory pointer
thunderbolt: Remove service debugfs entries during unregister
thunderbolt: Remove XDomain from the bus without holding tb->lock
thunderbolt: Add tb_property_merge_dir()
thunderbolt: Add KUnit test for tb_property_merge_dir()
thunderbolt: Allow service drivers to specify their own properties
thunderbolt / net: Move ring_frame_size() to thunderbolt.h
thunderbolt / net: Let the service drivers configure interrupt throttling
thunderbolt: Add helper to figure size of the ring
thunderbolt: Add tb_ring_flush()
thunderbolt: Add support for ConfigFS
thunderbolt: Add support for USB4STREAM
docs: admin-guide: thunderbolt: Add instructions how to use USB4STREAM
Nathan Chancellor (1):
usb: typec: intel_pmc_mux: Zero initialize num_ports in pmc_usb_probe()
Niklas Neronin (4):
usb: xhci: remove legacy 'num_trbs_free' tracking
usb: xhci: refactor DCBAA struct
usb: xhci: allocate DCBAA based on host controller max slots
usb: xhci: allocate internal DCBAA mirror dynamically
Oliver Neukum (1):
usb: core: hcd: fix possible deadlock in rh control transfers
Pawel Laszczak (3):
usb: cdnsp: add support for eUSB2v2 port
dt-bindings: usb: cdns3: Add cdns,cdnsp compatible string
usb: cdnsp: Add support for device-only configuration
Pengyu Luo (1):
usb: ucsi: huawei_gaokun: support mode switching
Peter Chen (3):
dt-bindings: usb: cdns,usb3: document USBSSP controller support
usb: cdns3: Add USBSSP platform driver support
usb: cdns3: plat: fix leaked role switch on core role initialization failure
Pooja Katiyar (4):
thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host()
usb: typec: ucsi: Add support for message_out data structure
usb: typec: ucsi: Enable debugfs for message_out data structure
usb: typec: ucsi: Add support for SET_PDOS command
Rosen Penev (1):
usb: typec: intel_pmc_mux: combine kzalloc + kcalloc
Sergey Senozhatsky (1):
usb: typec: ucsi: split connector lock classes
Seungjin Bae (2):
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
usb: host: max3421: Reject hub port requests for non-existent ports
Shuping Bu (1):
usb: dwc3: core: Fix incorrect kernel-doc comment for dwc3_alloc_event_buffers
Stepan Ionichev (2):
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
usb: xhci: fix typo in xhci_set_port_power() comment
Swati Agarwal (2):
dt-bindings: usb: Add Genesys Logic GL3590 hub
usb: misc: onboard_usb_hub: Add Genesys Logic GL3590 hub support
Uwe Kleine-König (The Capable Hub) (3):
usb: typec: Use named initializers for arrays of i2c_device_data
usb: misc: Use named initializers for struct i2c_device_id
usb: phy: isp1301: Use named initializers for struct i2c_device_id
Xu Rao (3):
thunderbolt: test: Release third DP tunnel
thunderbolt: debugfs: Fix margining error counter buffer leak
thunderbolt: debugfs: Fix sideband write size check
Xu Yang (3):
usb: gadget: udc: skip pullup() if already connected
usb: chipidea: udc: add a helper ci_udc_enable_vbus_irq()
usb: chipidea: udc: support dynamic gadget add/remove
.../ABI/testing/configfs-thunderbolt_stream | 83 +
.../ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 2 +-
Documentation/admin-guide/thunderbolt.rst | 61 +
.../devicetree/bindings/usb/cdns,usb3.yaml | 73 +-
.../devicetree/bindings/usb/ci-hdrc-usb2.yaml | 25 +-
.../devicetree/bindings/usb/genesys,gl850g.yaml | 18 +
.../devicetree/bindings/usb/qcom,pmic-typec.yaml | 9 +-
.../devicetree/bindings/usb/richtek,rt1711h.txt | 44 -
.../devicetree/bindings/usb/rockchip,dwc3.yaml | 3 +
Documentation/hwmon/index.rst | 1 +
Documentation/hwmon/prom21-xhci.rst | 101 ++
.../translations/zh_CN/subsystem-apis.rst | 2 +-
Documentation/translations/zh_CN/usb/CREDITS | 163 ++
Documentation/translations/zh_CN/usb/acm.rst | 147 ++
.../translations/zh_CN/usb/authorization.rst | 139 ++
Documentation/translations/zh_CN/usb/chipidea.rst | 150 ++
Documentation/translations/zh_CN/usb/dwc3.rst | 63 +
Documentation/translations/zh_CN/usb/ehci.rst | 261 +++
Documentation/translations/zh_CN/usb/index.rst | 54 +
Documentation/translations/zh_CN/usb/usbmon.rst | 427 +++++
arch/arm/mach-pxa/devices.c | 7 -
arch/arm/mach-pxa/gumstix.c | 1 -
arch/arm/mach-pxa/udc.h | 8 -
arch/arm64/boot/dts/qcom/pm4125.dtsi | 1 -
arch/arm64/boot/dts/qcom/pm7250b.dtsi | 1 -
arch/arm64/boot/dts/qcom/pm8150b.dtsi | 1 -
arch/arm64/boot/dts/qcom/pmi632.dtsi | 1 -
arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +
arch/arm64/boot/dts/qcom/qrb4210-rb2.dts | 2 +
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +
arch/arm64/boot/dts/qcom/sdm632-fairphone-fp3.dts | 2 +
arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +
arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 2 +
arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 2 +
.../boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi | 2 +
drivers/hwmon/Kconfig | 10 +
drivers/hwmon/Makefile | 1 +
drivers/hwmon/prom21-xhci.c | 239 +++
drivers/net/thunderbolt/main.c | 20 +-
drivers/thunderbolt/Kconfig | 15 +
drivers/thunderbolt/Makefile | 6 +-
drivers/thunderbolt/acpi.c | 14 +-
drivers/thunderbolt/configfs.c | 61 +
drivers/thunderbolt/ctl.c | 16 +-
drivers/thunderbolt/debugfs.c | 18 +-
drivers/thunderbolt/dma_test.c | 25 +-
drivers/thunderbolt/domain.c | 37 +-
drivers/thunderbolt/eeprom.c | 2 +-
drivers/thunderbolt/icm.c | 39 +-
drivers/thunderbolt/nhi.c | 606 ++-----
drivers/thunderbolt/nhi.h | 33 +-
drivers/thunderbolt/nhi_ops.c | 185 ---
drivers/thunderbolt/nhi_regs.h | 3 +-
drivers/thunderbolt/path.c | 37 +-
drivers/thunderbolt/pci.c | 622 +++++++
drivers/thunderbolt/property.c | 164 +-
drivers/thunderbolt/stream.c | 1698 ++++++++++++++++++++
drivers/thunderbolt/switch.c | 77 +-
drivers/thunderbolt/tb.c | 86 +-
drivers/thunderbolt/tb.h | 21 +-
drivers/thunderbolt/tb_regs.h | 19 +-
drivers/thunderbolt/test.c | 249 +++
drivers/thunderbolt/tunnel.c | 35 +
drivers/thunderbolt/usb4.c | 35 +-
drivers/thunderbolt/usb4_port.c | 2 +-
drivers/thunderbolt/xdomain.c | 315 +++-
drivers/usb/Makefile | 2 -
drivers/usb/atm/ueagle-atm.c | 58 +-
drivers/usb/cdns3/Kconfig | 112 +-
drivers/usb/cdns3/Makefile | 46 +-
drivers/usb/cdns3/cdns3-gadget.c | 1 +
drivers/usb/cdns3/cdns3-plat.c | 58 +-
drivers/usb/cdns3/cdnsp-gadget.c | 50 +-
drivers/usb/cdns3/cdnsp-gadget.h | 1 +
drivers/usb/cdns3/cdnsp-mem.c | 73 +-
drivers/usb/cdns3/cdnsp-pci.c | 243 ++-
drivers/usb/cdns3/cdnsp-ring.c | 9 +-
drivers/usb/cdns3/core.c | 48 +-
drivers/usb/cdns3/core.h | 9 +-
drivers/usb/cdns3/drd.c | 45 +-
drivers/usb/cdns3/gadget-export.h | 10 +-
drivers/usb/cdns3/host-export.h | 4 +-
drivers/usb/chipidea/core.c | 11 +-
drivers/usb/chipidea/udc.c | 93 +-
drivers/usb/class/cdc-acm.c | 6 +
drivers/usb/core/hcd.c | 14 +-
drivers/usb/dwc2/hcd_intr.c | 10 +-
drivers/usb/dwc3/core.c | 14 +-
drivers/usb/dwc3/dwc3-google.c | 5 +-
drivers/usb/dwc3/dwc3-octeon.c | 12 +-
drivers/usb/gadget/udc/aspeed_udc.c | 7 +-
drivers/usb/gadget/udc/core.c | 7 +-
drivers/usb/gadget/udc/goku_udc.c | 3 +-
drivers/usb/gadget/udc/pxa25x_udc.c | 41 +-
drivers/usb/gadget/udc/pxa25x_udc.h | 2 +-
drivers/usb/gadget/udc/pxa27x_udc.c | 35 +-
drivers/usb/gadget/udc/pxa27x_udc.h | 2 -
drivers/usb/host/Kconfig | 8 +-
drivers/usb/host/Makefile | 1 +
drivers/usb/host/max3421-hcd.c | 8 +
drivers/usb/host/xhci-dbgcap.c | 144 +-
drivers/usb/host/xhci-dbgcap.h | 3 +
drivers/usb/host/xhci-hub.c | 7 +-
drivers/usb/host/xhci-mem.c | 60 +-
drivers/usb/host/xhci-mtk.c | 6 +-
drivers/usb/host/xhci-pci-prom21.c | 137 ++
drivers/usb/host/xhci-pci.c | 11 +
drivers/usb/host/xhci-pci.h | 3 +
drivers/usb/host/xhci-rcar.c | 70 +-
drivers/usb/host/xhci-ring.c | 53 +-
drivers/usb/host/xhci.c | 23 +-
drivers/usb/host/xhci.h | 29 +-
drivers/usb/misc/Kconfig | 2 +-
drivers/usb/misc/onboard_usb_dev.c | 1 +
drivers/usb/misc/onboard_usb_dev.h | 8 +
drivers/usb/misc/usb251xb.c | 18 +-
drivers/usb/misc/usb3503.c | 2 +-
drivers/usb/misc/usb4604.c | 2 +-
drivers/usb/phy/phy-isp1301.c | 2 +-
drivers/usb/serial/ark3116.c | 1 -
drivers/usb/serial/belkin_sa.c | 2 -
drivers/usb/serial/cyberjack.c | 2 -
drivers/usb/serial/cypress_m8.c | 2 -
drivers/usb/serial/digi_acceleport.c | 2 -
drivers/usb/serial/empeg.c | 3 -
drivers/usb/serial/f81232.c | 3 -
drivers/usb/serial/f81534.c | 1 -
drivers/usb/serial/ftdi_sio.c | 1 -
drivers/usb/serial/garmin_gps.c | 3 -
drivers/usb/serial/generic.c | 1 -
drivers/usb/serial/io_edgeport.c | 2 +-
drivers/usb/serial/io_ti.c | 2 -
drivers/usb/serial/ipaq.c | 3 -
drivers/usb/serial/ipw.c | 2 -
drivers/usb/serial/ir-usb.c | 2 -
drivers/usb/serial/iuu_phoenix.c | 2 -
drivers/usb/serial/keyspan.c | 2 -
drivers/usb/serial/keyspan_pda.c | 2 -
drivers/usb/serial/kl5kusb105.c | 2 -
drivers/usb/serial/kobil_sct.c | 2 -
drivers/usb/serial/mct_u232.c | 2 -
drivers/usb/serial/metro-usb.c | 3 -
drivers/usb/serial/mos7720.c | 3 +-
drivers/usb/serial/mos7840.c | 1 -
drivers/usb/serial/mxuport.c | 40 +-
drivers/usb/serial/omninet.c | 2 -
drivers/usb/serial/opticon.c | 2 -
drivers/usb/serial/option.c | 1 -
drivers/usb/serial/oti6858.c | 3 -
drivers/usb/serial/pl2303.c | 3 -
drivers/usb/serial/qcserial.c | 1 -
drivers/usb/serial/quatech2.c | 2 -
drivers/usb/serial/safe_serial.c | 2 -
drivers/usb/serial/spcp8x5.c | 2 -
drivers/usb/serial/ssu100.c | 2 -
drivers/usb/serial/symbolserial.c | 2 -
drivers/usb/serial/ti_usb_3410_5052.c | 2 -
drivers/usb/serial/usb-serial.c | 3 -
drivers/usb/serial/usb_wwan.c | 1 -
drivers/usb/serial/visor.c | 4 -
drivers/usb/serial/whiteheat.c | 4 -
drivers/usb/serial/wishbone-serial.c | 1 -
drivers/usb/serial/xr_serial.c | 1 +
drivers/usb/serial/xsens_mt.c | 1 -
drivers/usb/typec/anx7411.c | 4 +-
drivers/usb/typec/mux/fsa4480.c | 2 +-
drivers/usb/typec/mux/intel_pmc_mux.c | 19 +-
drivers/usb/typec/mux/it5205.c | 2 +-
drivers/usb/typec/mux/nb7vpq904m.c | 2 +-
drivers/usb/typec/mux/pi3usb30532.c | 2 +-
drivers/usb/typec/mux/ps883x.c | 350 ++--
drivers/usb/typec/mux/ptn36502.c | 2 +-
drivers/usb/typec/mux/wcd939x-usbss.c | 2 +-
drivers/usb/typec/tcpm/fusb302.c | 4 +-
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 5 -
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 12 +-
drivers/usb/typec/tcpm/tcpci.c | 13 +-
drivers/usb/typec/tcpm/tcpci_maxim_core.c | 2 +-
drivers/usb/typec/tcpm/tcpci_rt1711h.c | 8 +-
drivers/usb/typec/tipd/core.c | 2 +-
drivers/usb/typec/ucsi/cros_ec_ucsi.c | 6 +-
drivers/usb/typec/ucsi/debugfs.c | 31 +
drivers/usb/typec/ucsi/ucsi.c | 60 +-
drivers/usb/typec/ucsi/ucsi.h | 21 +-
drivers/usb/typec/ucsi/ucsi_acpi.c | 22 +-
drivers/usb/typec/ucsi/ucsi_ccg.c | 10 +-
drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 53 +-
drivers/usb/typec/ucsi/ucsi_stm32g0.c | 4 +-
drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 6 +-
drivers/usb/usbip/Kconfig | 2 +-
drivers/usb/usbip/vhci_sysfs.c | 52 +-
include/linux/platform_data/pxa2xx_udc.h | 15 -
include/linux/platform_data/usb-xhci-prom21.h | 22 +
include/linux/thunderbolt.h | 59 +-
194 files changed, 6991 insertions(+), 2114 deletions(-)
create mode 100644 Documentation/ABI/testing/configfs-thunderbolt_stream
delete mode 100644 Documentation/devicetree/bindings/usb/richtek,rt1711h.txt
create mode 100644 Documentation/hwmon/prom21-xhci.rst
create mode 100644 Documentation/translations/zh_CN/usb/CREDITS
create mode 100644 Documentation/translations/zh_CN/usb/acm.rst
create mode 100644 Documentation/translations/zh_CN/usb/authorization.rst
create mode 100644 Documentation/translations/zh_CN/usb/chipidea.rst
create mode 100644 Documentation/translations/zh_CN/usb/dwc3.rst
create mode 100644 Documentation/translations/zh_CN/usb/ehci.rst
create mode 100644 Documentation/translations/zh_CN/usb/index.rst
create mode 100644 Documentation/translations/zh_CN/usb/usbmon.rst
delete mode 100644 arch/arm/mach-pxa/udc.h
create mode 100644 drivers/hwmon/prom21-xhci.c
create mode 100644 drivers/thunderbolt/configfs.c
delete mode 100644 drivers/thunderbolt/nhi_ops.c
create mode 100644 drivers/thunderbolt/pci.c
create mode 100644 drivers/thunderbolt/stream.c
create mode 100644 drivers/usb/host/xhci-pci-prom21.c
create mode 100644 include/linux/platform_data/usb-xhci-prom21.h
^ permalink raw reply
* Re: [PATCH] usb: gadget: tegra-xudc: drain EP pipeline before dma_unmap
From: Jon Hunter @ 2026-06-22 13:24 UTC (permalink / raw)
To: Vishal Kumar, linux-usb
Cc: gregkh, thierry.reding, linux-tegra, linux-kernel, stable
In-Reply-To: <20260606024011.1160110-1-vishalmimani008@gmail.com>
On 06/06/2026 03:40, Vishal Kumar wrote:
> On Tegra186/194/234 the XUDC posts a transfer-completion event when the
> DMA write is dispatched to the AXI interconnect, before the store is
> committed to memory. Under SMMU strict mode dma_unmap() synchronously
> invalidates the IOVA TLB entry. An in-flight AXI write to the
> just-unmapped IOVA triggers a translation fault (fsr=0x402) that
> permanently wedges the bulk-OUT endpoint.
>
> Observed on Tegra234 (Jetson Orin Nano) at ~170 MB/s USB-NCM transfers:
>
> arm-smmu 8000000.iommu: Unhandled context fault: fsr=0x402,
> iova=0xfffb5000, cbfrsynra=0x100f, cb=3
> tegra-mc 2c00000.memory-controller: EMEM address decode error
>
> cbfrsynra=0x100f identifies XUDC (StreamID 0x0f per DT), cb=3 is iommu
> group 4 (3550000.usb). fsr=0x402 is a translation fault on a DMA write.
>
> Fix: poll EP_THREAD_ACTIVE before calling usb_gadget_unmap_request() for
> non-control endpoints. EP_THREAD_ACTIVE clearing is the hardware's
> guarantee that the endpoint sequencer is idle and all AXI transactions
> have completed, so the subsequent TLB invalidation cannot race an
> in-flight write.
>
> Also change ep_wait_for_inactive() to return the readl_poll_timeout()
> status so callers can detect a timeout. On timeout in the completion
> path, skip dma_unmap() to avoid the translation fault and force
> req->usb_req.status = -EIO so the gadget driver does not treat the
> transfer as successful or requeue the still-mapped buffer. On timeout
> in the dequeue path, emit a warning.
>
> Fixes: 49d6f3dd4abe ("usb: gadget: add tegra xusb device mode driver")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Vishal Kumar <vishalmimani008@gmail.com>
> ---
> drivers/usb/gadget/udc/tegra-xudc.c | 47 ++++++++++++++++++++++------
> 1 file changed, 38 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
> index 0b63b8c0a..3f18beddf 100644
> --- a/drivers/usb/gadget/udc/tegra-xudc.c
> +++ b/drivers/usb/gadget/udc/tegra-xudc.c
> @@ -1023,9 +1023,9 @@ static void ep_wait_for_stopped(struct tegra_xudc *xudc, unsigned int ep)
> xudc_writel(xudc, BIT(ep), EP_STOPPED);
> }
>
> -static void ep_wait_for_inactive(struct tegra_xudc *xudc, unsigned int ep)
> +static int ep_wait_for_inactive(struct tegra_xudc *xudc, unsigned int ep)
> {
> - xudc_readl_poll(xudc, EP_THREAD_ACTIVE, BIT(ep), 0);
> + return xudc_readl_poll(xudc, EP_THREAD_ACTIVE, BIT(ep), 0);
> }
>
> static void tegra_xudc_req_done(struct tegra_xudc_ep *ep,
> @@ -1046,8 +1046,39 @@ static void tegra_xudc_req_done(struct tegra_xudc_ep *ep,
> (xudc->setup_state ==
> DATA_STAGE_XFER));
> } else {
> - usb_gadget_unmap_request(&xudc->gadget, &req->usb_req,
> - usb_endpoint_dir_in(ep->desc));
> + /*
> + * Drain the endpoint DMA pipeline before unmapping.
> + *
> + * Under SMMU strict mode dma_unmap() synchronously
> + * invalidates the IOVA TLB entry. On Tegra186/194/234 the
> + * XUDC appears to post the completion event when the DMA
> + * write is dispatched to the AXI interconnect, before the
> + * store is committed to memory. A subsequent dma_unmap()
> + * can remove the IOVA translation while the write is still
> + * in-flight, triggering a translation fault (fsr=0x402) that
> + * permanently wedges the bulk endpoint.
> + *
> + * Wait for EP_THREAD_ACTIVE to clear (endpoint sequencer
> + * idle). On timeout skip the unmap to avoid the SMMU fault;
> + * the DMA mapping leaks but the hardware is already in an
> + * unrecoverable state.
> + */
> + if (!WARN_ONCE(ep_wait_for_inactive(xudc, ep->index),
> + "ep%u: DMA drain timed out; skipping dma_unmap\n",
> + ep->index)) {
> + /* Read-back completes the poll barrier; EP_THREAD_ACTIVE=0 guarantees DMA is idle. */
> + xudc_readl(xudc, EP_THREAD_ACTIVE);
The ep_wait_for_inactive() is reading the EP_THREAD_ACTIVE and so this
would appear to be redundant.
> + usb_gadget_unmap_request(&xudc->gadget, &req->usb_req,
> + usb_endpoint_dir_in(ep->desc));
> + } else {
> + /*
> + * Timeout: mapping is intentionally leaked to avoid the
> + * SMMU fault. Force -EIO so the gadget driver does not
> + * treat this as a successful transfer and reuse the
> + * still-mapped buffer.
> + */
> + req->usb_req.status = -EIO;
The above is confusing. Wouldn't it be simpler to have ...
if (WARN_ONCE(ep_wait_for_inactive())) {
req->usb_req.status = -EIO;
} else {
xudc_readl(xudc, EP_THREAD_ACTIVE);
usb_gadget_unmap_request(...);
}
Furthermore, it seems that if this now fails then we don't unmap the
buffer, but we still give back the request afterwards anyway.
> + }
> }
>
> spin_unlock(&xudc->lock);
> @@ -1443,10 +1474,12 @@ __tegra_xudc_ep_dequeue(struct tegra_xudc_ep *ep,
> return 0;
> }
>
> - /* Halt DMA for this endpiont. */
> + /* Halt DMA for this endpoint. */
> if (ep_ctx_read_state(ep->context) == EP_STATE_RUNNING) {
> ep_pause(xudc, ep->index);
> - ep_wait_for_inactive(xudc, ep->index);
> + if (ep_wait_for_inactive(xudc, ep->index))
> + dev_warn(xudc->dev, "ep%u: DMA drain timed out during dequeue\n",
> + ep->index);
Maybe it is better to put the warning in the ep_wait_for_inactive()
function.
> }
>
> deq_trb = trb_phys_to_virt(ep, ep_ctx_read_deq_ptr(ep->context));
>
> 2.39.0
--
nvpublic
^ permalink raw reply
* Re: [PATCH 0/2] tracing: Move trace_printk.h out of kernel.h
From: Yury Norov @ 2026-06-22 13:11 UTC (permalink / raw)
To: Steven Rostedt
Cc: Christophe Leroy (CS GROUP), linux-kernel, linux-trace-kernel,
Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Linus Torvalds, Sebastian Andrzej Siewior, John Ogness,
Thomas Gleixner, Peter Zijlstra, Julia Lawall, Yury Norov,
linux-doc, linux-kbuild, linuxppc-dev, dri-devel, linux-stm32,
linux-arm-kernel, linux-rdma, linux-usb, linux-ext4, linux-nfs,
kvm, intel-gfx
In-Reply-To: <20260622090826.20efadb3@fedora>
On Mon, Jun 22, 2026 at 09:08:26AM -0400, Steven Rostedt wrote:
> On Mon, 22 Jun 2026 10:05:13 +0200
> "Christophe Leroy (CS GROUP)" <chleroy@kernel.org> wrote:
>
> > > There's been complaints about trace_printk() being defined in kernel.h as it
> > > can increase the compilation time. As it is only used by some developers for
> > > debugging purposes, it should not be in kernel.h causing lots of wasted CPU
> > > cycles for those that do not ever care about it.
> >
> > Do we have a measurement of the increased compilation time ?
>
> I believe Yury does.
I re-run compilation is a more strict environment, and the difference
is negligible.
^ permalink raw reply
* Re: [PATCH 0/2] tracing: Move trace_printk.h out of kernel.h
From: Steven Rostedt @ 2026-06-22 13:08 UTC (permalink / raw)
To: Christophe Leroy (CS GROUP)
Cc: linux-kernel, linux-trace-kernel, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Andrew Morton, Linus Torvalds,
Sebastian Andrzej Siewior, John Ogness, Thomas Gleixner,
Peter Zijlstra, Julia Lawall, Yury Norov, linux-doc, linux-kbuild,
linuxppc-dev, dri-devel, linux-stm32, linux-arm-kernel,
linux-rdma, linux-usb, linux-ext4, linux-nfs, kvm, intel-gfx
In-Reply-To: <dbb5915e-6587-4de9-87f3-76bea5024da8@kernel.org>
On Mon, 22 Jun 2026 10:05:13 +0200
"Christophe Leroy (CS GROUP)" <chleroy@kernel.org> wrote:
> > There's been complaints about trace_printk() being defined in kernel.h as it
> > can increase the compilation time. As it is only used by some developers for
> > debugging purposes, it should not be in kernel.h causing lots of wasted CPU
> > cycles for those that do not ever care about it.
>
> Do we have a measurement of the increased compilation time ?
I believe Yury does.
-- Steve
^ permalink raw reply
* Re: [PATCH] usb: misc: usbsevseg: replace deprecated simple_strtoul with kstrtouint
From: Oliver Neukum @ 2026-06-22 13:03 UTC (permalink / raw)
To: Jad Keskes, gregkh; +Cc: linux-usb, linux-kernel
In-Reply-To: <20260622125045.2398164-1-inasj268@gmail.com>
On 22.06.26 14:50, Jad Keskes wrote:
> simple_strtoul() is deprecated. kstrtouint() actually tells you when
> the input is garbage instead of silently accepting zero.
That changes the API visible to user space. Is this a good idea?
Regards
Oliver
^ permalink raw reply
* [PATCH] usb: misc: usbsevseg: replace deprecated simple_strtoul with kstrtouint
From: Jad Keskes @ 2026-06-22 12:50 UTC (permalink / raw)
To: gregkh; +Cc: linux-usb, linux-kernel, Jad Keskes
simple_strtoul() is deprecated. kstrtouint() actually tells you when
the input is garbage instead of silently accepting zero.
Fixes 3 sysfs store paths (powered, mode_msb, mode_lsb) from one
macro expansion.
Signed-off-by: Jad Keskes <inasj268@gmail.com>
---
drivers/usb/misc/usbsevseg.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
index 89d25fcef642..2c08d8ee7d86 100644
--- a/drivers/usb/misc/usbsevseg.c
+++ b/drivers/usb/misc/usbsevseg.c
@@ -154,7 +154,13 @@ static ssize_t name##_store(struct device *dev, \
struct usb_interface *intf = to_usb_interface(dev); \
struct usb_sevsegdev *mydev = usb_get_intfdata(intf); \
\
- mydev->name = simple_strtoul(buf, NULL, 10); \
+ unsigned int val; \
+ int ret; \
+ \
+ ret = kstrtouint(buf, 10, &val); \
+ if (ret < 0) \
+ return ret; \
+ mydev->name = val; \
update_fcn(mydev); \
\
return count; \
--
2.54.0
^ permalink raw reply related
* [PATCH] usb: misc: cytherm: replace deprecated simple_strtoul with kstrtoint
From: Jad Keskes @ 2026-06-22 12:31 UTC (permalink / raw)
To: gregkh; +Cc: linux-usb, linux-kernel, Jad Keskes
simple_strtoul() is deprecated in favor of kstrtoint(). The old
function silently accepts garbage input. kstrtoint() returns -EINVAL
so the driver can actually tell the user they typed something stupid
instead of accepting 0 and wondering why the thermometer isn't
responding.
The 0-255 clamping stays the same, just with proper error handling
in front of it now.
Signed-off-by: Jad Keskes <inasj268@gmail.com>
---
drivers/usb/misc/cytherm.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/misc/cytherm.c b/drivers/usb/misc/cytherm.c
index b183df9826bc..81de3fecf3da 100644
--- a/drivers/usb/misc/cytherm.c
+++ b/drivers/usb/misc/cytherm.c
@@ -85,7 +85,9 @@ static ssize_t brightness_store(struct device *dev, struct device_attribute *att
if (!buffer)
return 0;
- cytherm->brightness = simple_strtoul(buf, NULL, 10);
+ retval = kstrtoint(buf, 10, &cytherm->brightness);
+ if (retval < 0)
+ return retval;
if (cytherm->brightness > 0xFF)
cytherm->brightness = 0xFF;
@@ -217,7 +219,9 @@ static ssize_t port0_store(struct device *dev, struct device_attribute *attr, co
if (!buffer)
return 0;
- tmp = simple_strtoul(buf, NULL, 10);
+ retval = kstrtoint(buf, 10, &tmp);
+ if (retval < 0)
+ return retval;
if (tmp > 0xFF)
tmp = 0xFF;
@@ -272,7 +276,9 @@ static ssize_t port1_store(struct device *dev, struct device_attribute *attr, co
if (!buffer)
return 0;
- tmp = simple_strtoul(buf, NULL, 10);
+ retval = kstrtoint(buf, 10, &tmp);
+ if (retval < 0)
+ return retval;
if (tmp > 0xFF)
tmp = 0xFF;
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox