The EP-IN of MIDI2 (altset 1) wasn't initialized in
f_midi2_create_usb_configs() as it's an INT EP unlike others BULK
EPs.  But this leaves rather the max packet size unchanged no matter
which speed is used, resulting in the very slow access.
And the wMaxPacketSize values set there look legit for INT EPs, so
let's initialize the MIDI2 EP-IN there for achieving the equivalent
speed as well.

Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20250905133240.20966-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The gadget card driver forgot to call snd_ump_update_group_attrs()
after adding FBs, and this leaves the UMP group attributes
uninitialized.  As a result, -ENODEV error is returned at opening a
legacy rawmidi device as an inactive group.

This patch adds the missing call to address the behavior above.

Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20250904153932.13589-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Yunseong Kim and the syzbot fuzzer both reported a problem in
RT-enabled kernels caused by the way dummy-hcd mixes interrupt
management and spin-locking.  The pattern was:

	local_irq_save(flags);
	spin_lock(&dum->lock);
	...
	spin_unlock(&dum->lock);
	...		// calls usb_gadget_giveback_request()
	local_irq_restore(flags);

The code was written this way because usb_gadget_giveback_request()
needs to be called with interrupts disabled and the private lock not
held.

While this pattern works fine in non-RT kernels, it's not good when RT
is enabled.  RT kernels handle spinlocks much like mutexes; in particular,
spin_lock() may sleep.  But sleeping is not allowed while local
interrupts are disabled.

To fix the problem, rewrite the code to conform to the pattern used
elsewhere in dummy-hcd and other UDC drivers:

	spin_lock_irqsave(&dum->lock, flags);
	...
	spin_unlock(&dum->lock);
	usb_gadget_giveback_request(...);
	spin_lock(&dum->lock);
	...
	spin_unlock_irqrestore(&dum->lock, flags);

This approach satisfies the RT requirements.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Fixes: b4dbda1a22d2 ("USB: dummy-hcd: disable interrupts during req->complete")
Reported-by: Yunseong Kim <ysk@kzalloc.com>
Closes: <https://lore.kernel.org/linux-usb/5b337389-73b9-4ee4-a83e-7e82bf5af87a@kzalloc.com/>
Reported-by: syzbot+8baacc4139f12fa77909@syzkaller.appspotmail.com
Closes: <https://lore.kernel.org/linux-usb/68ac2411.050a0220.37038e.0087.GAE@google.com/>
Tested-by: syzbot+8baacc4139f12fa77909@syzkaller.appspotmail.com
CC: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
CC: stable@vger.kernel.org
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/bb192ae2-4eee-48ee-981f-3efdbbd0d8f0@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Upon resume from system suspend, the PM runtime core issues the
following warning:

tegra-xudc 3550000.usb: Runtime PM usage count underflow!

This is because tegra_xudc_resume() unconditionally calls
schedule_work(&xudc->usb_role_sw_work) whether or not anything has
changed, which causes tegra_xudc_device_mode_off() to be called
even when we're already in that mode.

Keep track of the current state of "device_mode", and only schedule
this work if it has changed from the hardware state on resume.

Signed-off-by: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/E1uhtkH-007KDZ-JT@rmk-PC.armlinux.org.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for
  6.17-rc1.

  Lots of little things in here, mostly all small cleanups and updates,
  no major new features this development cycle. Stuff included in here
  is:

   - xhci minor tweaks for error handling

   - typec minor updates and a driver update

   - gadget driver api cleanups

   - unused function removals

   - unbind memory leak fixes

   - a few new device ids added

   - a few new devices supported for some drivers

   - other minor cleanups and changes

  All of these have been in linux-next with no reported issues, with the
  leak fixes being in the shortest amount of time, but they are
  'obviously correct' :)"

* tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (100 commits)
  usb: musb: omap2430: clean up probe error handling
  usb: musb: omap2430: fix device leak at unbind
  usb: gadget: udc: renesas_usb3: fix device leak at unbind
  usb: dwc3: meson-g12a: fix device leaks at unbind
  usb: dwc3: imx8mp: fix device leak at unbind
  usb: musb: omap2430: enable compile testing
  usb: gadget: udc: renesas_usb3: drop unused module alias
  usb: xhci: print xhci->xhc_state when queue_command failed
  usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  USB: serial: option: add Foxconn T99W709
  usb: core: add urb->sgt parameter description
  thunderbolt: Fix copy+paste error in match_service_id()
  usb: typec: ucsi: Update power_supply on power role change
  usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  usb: typec: fusb302: cache PD RX state
  usb: typec: ucsi: yoga-c630: add DRM dependency
  usb: gadget : fix use-after-free in composite_dev_cleanup()
  usb: chipidea: imx: Add a missing blank line
  usb: gadget: f_uac1: replace scnprintf() with sysfs_emit()
  usb: usblp: clean up assignment inside if conditions
  ...

Pull gpio updates from Bartosz Golaszewski:
 "There's one new driver (Apple SMC) and extensions to existing drivers
  for supporting new HW models. A lot of different impovements across
  drivers and in core GPIO code. Details on that are in the signed tag
  as usual.

  We managed to remove some of the legacy APIs. Arnd Bergmann started to
  work on making the legacy bits optional so that we may compile them
  only for older platforms that still really need them.

  Rob Herring has done a lot of work to convert legacy .txt dt-bindings
  for GPIO controllers to YAML. There are only a few left now in the
  GPIO tree.

  A big part of the commits in this PR concern the conversion of GPIO
  drivers to using the new line value setter callbacks. This conversion
  is now complete treewide (unless I've missed something) and once all
  the changes from different trees land in mainline, I'll send you
  another PR containing a commit dropping the legacy callbacks from the
  tree.

  As the quest to pay back technical dept never really ends, we're
  starting another set of interface conversions, this time it's about
  moving fields specific to only a handful of drivers using the
  gpio-mmio helper out of the core gpio_chip structure that every
  controller implements and uses. This cycle we introduce a new set of
  APIs and convert a few drivers under drivers/gpio/, next cycle we'll
  convert remaining modules treewide (in gpio, pinctrl and mfd trees)
  and finally remove the old interfaces and move the gpio-mmio fields
  into their own structure wrapping gpio_chip.

  One last change I should mention here is the rework of the sysfs
  interface. In 2016, we introduced the GPIO character device as the
  preferred alternative to the sysfs class under /sys/class/gpio. While
  it has seen a wide adoption with the help of its user-space
  counterpart - libgpiod - there are still users who prefer the
  simplicity of sysfs.

  As far as the GPIO subsystem is concerned, the problem is not the
  existince of the GPIO class as such but rather the fact that it
  exposes the global GPIO numbers to the user-space, stopping us from
  ever being able to remove the numberspace from the kernel. To that
  end, this release we introduced a parallel, limited sysfs interface
  that doesn't expose these numbers and only implements a subset of
  features that are relevant to the existing users. This is a result of
  several discussions over the course of last year and should allow us
  to remove the legacy part some time in the future.

  Summary:

  GPIOLIB core:
   - introduce a parallel, limited sysfs user ABI that doesn't expose
     the global GPIO numbers to user-space while maintaining backward
     compatibility with the end goal of it completely replacing the
     existing interface, allowing us to remove it
   - remove the legacy devm_gpio_request() routine which has no more
     users
   - start the process of allowing to compile-out the legacy parts of
     the GPIO core for users who don't need it by introducing a new
     Kconfig option: GPIOLIB_LEGACY
   - don't use global GPIO numbers in debugfs output from the core code
     (drivers still do it, the work is ongoing)
   - start the process of moving the fields specific to the gpio-mmio
     helper out of the core struct gpio_chip into their own structure
     that wraps it: create a new header with modern interfaces and
     convert several drivers to using it
   - remove the platform data structure associated with the gpio-mmio
     helper from the kernel after having converted all remaining users
     to generic device properties
   - remove legacy struct gpio definition as it has no more users

  New drivers:
   - add the GPIO driver for the Apple System Management Controller

  Driver improvements:
   - add support for new models to gpio-adp5585, gpio-tps65219 and
     gpio-pca953x
   - extend the interrupt support in gpio-loongson-64bit
   - allow to mark the simulated GPIO lines as invalid in gpio-sim
   - convert all remaining GPIO drivers to using the new GPIO value
     setter callbacks
   - convert gpio-rcar to using simple device power management ops
     callbacks
   - don't check if current direction of a line is output before setting
     the value in gpio-pisosr and ti-fpc202: the GPIO core already
     handles that
   - also drop unneeded GPIO range checks in drivers, the core already
     makes sure we're within bounds when calling driver callbacks
   - use dev_fwnode() where applicable across GPIO drivers
   - set line value in gpio-zynqmp-modepin and gpio-twl6040 when the
     user wants to change direction of the pin to output even though
     these drivers don't need to do anything else to actually set the
     direction, otherwise a call like gpiod_direction_output(d, 1) will
     not result in the line driver high
   - remove the reduntant call to pm_runtime_mark_last_busy() from
     gpio-arizona
   - use lock guards in gpio-cadence and gpio-mxc
   - check the return values of regmap functions in gpio-wcd934x and
     gpio-tps65912
   - use better regmap interfaces in gpio-wcove and gpio-pca953x
   - remove dummy GPIO chip callbacks from several drivers in cases
     where the GPIO core can already handle their absence
   - allow building gpio-palmas as a module

  Fixes:
   - use correct bit widths (according to the documentation) in
     gpio-virtio

  Device-tree bindings:
   - convert several of the legacy .txt documents for many different
     devices to YAML, improving automatic validation
   - create a "trivial" GPIO DT schema that covers a wide range of
     simple hardware that share a set of basic GPIO properties
   - document new HW: Apple MAC SMC GPIO block and adp5589 I/O expander
   - document a new model for pca95xx
   - add and/or remove properties in YAML documents for gpio-rockchip,
     fsl,qoriq-gpio, arm,pl061 and gpio-xilinx

  Misc:
   - some minor refactoring in several places, adding/removing forward
     declarations, moving defines to better places, constify the
     arguments in some functions, remove duplicate includes, etc.
   - documentation updates"

* tag 'gpio-updates-for-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (202 commits)
  MIPS: alchemy: gpio: use new GPIO line value setter callbacks for the remaining chips
  gpiolib: enable CONFIG_GPIOLIB_LEGACY even for !GPIOLIB
  gpio: virtio: Fix config space reading.
  gpiolib: make legacy interfaces optional
  dt-bindings: gpio: rockchip: Allow use of a power-domain
  gpiolib: of: add forward declaration for struct device_node
  power: reset: macsmc-reboot: Add driver for rebooting via Apple SMC
  gpio: Add new gpio-macsmc driver for Apple Macs
  mfd: Add Apple Silicon System Management Controller
  soc: apple: rtkit: Make shmem_destroy optional
  dt-bindings: mfd: Add Apple Mac System Management Controller
  dt-bindings: power: reboot: Add Apple Mac SMC Reboot Controller
  dt-bindings: gpio: Add Apple Mac SMC GPIO block
  gpio: cadence: Remove duplicated include in gpio-cadence.c
  gpio: tps65219: Add support for TI TPS65214 PMIC
  gpio: tps65219: Update _IDX & _OFFSET macro prefix
  gpio: sysfs: Fix an end of loop test in gpiod_unexport()
  dt-bindings: gpio: Convert qca,ar7100-gpio to DT schema
  dt-bindings: gpio: Convert maxim,max3191x to DT schema
  dt-bindings: gpio: fsl,qoriq-gpio: Add missing mpc8xxx compatibles
  ...

Pull simple_recursive_removal() update from Al Viro:
 "Removing subtrees of kernel filesystems is done in quite a few places;
  unfortunately, it's easy to get wrong. A number of open-coded attempts
  are out there, with varying amount of bogosities.

  simple_recursive_removal() had been introduced for doing that with all
  precautions needed; it does an equivalent of rm -rf, with sufficient
  locking, eviction of anything mounted on top of the subtree, etc.

  This series converts a bunch of open-coded instances to using that"

* tag 'pull-simple_recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  functionfs, gadgetfs: use simple_recursive_removal()
  kill binderfs_remove_file()
  fuse_ctl: use simple_recursive_removal()
  pstore: switch to locked_recursive_removal()
  binfmt_misc: switch to locked_recursive_removal()
  spufs: switch to locked_recursive_removal()
  add locked_recursive_removal()
  better lockdep annotations for simple_recursive_removal()
  simple_recursive_removal(): saner interaction with fsnotify

Make sure to drop the reference to the companion device taken during
probe when the driver is unbound.

Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
Cc: stable@vger.kernel.org	# 4.19
Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Since commit f3323cd03e58 ("usb: gadget: udc: renesas_usb3: remove R-Car
H3 ES1.* handling") the driver only supports OF probe so drop the unused
platform module alias.

Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20250724092006.21216-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1. In func configfs_composite_bind() -> composite_os_desc_req_prepare():
if kmalloc fails, the pointer cdev->os_desc_req will be freed but not
set to NULL. Then it will return a failure to the upper-level function.
2. in func configfs_composite_bind() -> composite_dev_cleanup():
it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it
will attempt to use it.This will lead to a use-after-free issue.

BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0
Read of size 8 at addr 0000004827837a00 by task init/1

CPU: 10 PID: 1 Comm: init Tainted: G           O      5.10.97-oh #1
 kasan_report+0x188/0x1cc
 __asan_load8+0xb4/0xbc
 composite_dev_cleanup+0xf4/0x2c0
 configfs_composite_bind+0x210/0x7ac
 udc_bind_to_driver+0xb4/0x1ec
 usb_gadget_probe_driver+0xec/0x21c
 gadget_dev_desc_UDC_store+0x264/0x27c

Fixes: 37a3a533429e ("usb: gadget: OS Feature Descriptors support")
Cc: stable <stable@kernel.org>
Signed-off-by: Tao Xue <xuetao09@huawei.com>
Link: https://lore.kernel.org/r/20250721093908.14967-1-xuetao09@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>