linux.git/include/linux/usb, branch v6.18

usb: gadget: udc: fix use-after-free in usb_gadget_state_work

2025-10-28T14:46:02+00:00

A race condition during gadget teardown can lead to a use-after-free
in usb_gadget_state_work(), as reported by KASAN:

  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0
  Workqueue: events usb_gadget_state_work

The fundamental race occurs because a concurrent event (e.g., an
interrupt) can call usb_gadget_set_state() and schedule gadget->work
at any time during the cleanup process in usb_del_gadget().

Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after
device removal") attempted to fix this by moving flush_work() to after
device_del(). However, this does not fully solve the race, as a new
work item can still be scheduled *after* flush_work() completes but
before the gadget's memory is freed, leading to the same use-after-free.

This patch fixes the race condition robustly by introducing a 'teardown'
flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is
set during cleanup in usb_del_gadget() *before* calling flush_work() to
prevent any new work from being scheduled once cleanup has commenced.
The scheduling site, usb_gadget_set_state(), now checks this flag under
the lock before queueing the work, thus safely closing the race window.

Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue")
Cc: stable 
Signed-off-by: Jimmy Hu 
Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2025-10-04T23:07:08+00:00

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and thunderbolt drivers for 6.18-rc1. It
  was another normal development cycle, with lots of the usual drivers
  getting updates:

   - Thunderbolt driver cleanups and additions

   - dwc3 driver updates

   - dwc2 driver updates

   - typec driver updates

   - xhci driver updates and additions

   - offload USB engine updates for better power management

   - unused tracepoint removals

   - usb gadget fixes and updates as more users start to rely on these
     drivers instead of the "old" function gadget drivers

   - new USB device ids

   - other minor driver USB driver updates

   - new USB I/O driver framework and driver additions"

  The last item, the usb i/o driver, has an i2c and gpio driver added
  through this tree. Those drivers were acked by the respective
  subsystem maintainers.

  All of these have been in linux-next for a while"

* tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (132 commits)
  usb: vhci-hcd: Prevent suspending virtually attached devices
  USB: serial: option: add SIMCom 8230C compositions
  thunderbolt: Fix use-after-free in tb_dp_dprx_work
  usb: xhci: align PORTSC trace with one-based port numbering
  usb: xhci: correct indentation for PORTSC tracing function
  usb: xhci: improve TR Dequeue Pointer mask
  usb: xhci-pci: add support for hosts with zero USB3 ports
  usb: xhci: Update a comment about Stop Endpoint retries
  Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
  usb: gadget: f_rndis: Refactor bind path to use __free()
  usb: gadget: f_ecm: Refactor bind path to use __free()
  usb: gadget: f_acm: Refactor bind path to use __free()
  usb: gadget: f_ncm: Refactor bind path to use __free()
  usb: gadget: Introduce free_usb_request helper
  usb: gadget: Store endpoint pointer in usb_request
  usb: host: xhci-rcar: Add Renesas RZ/G3E USB3 Host driver support
  usb: host: xhci-plat: Add .post_resume_quirk for struct xhci_plat_priv
  usb: host: xhci-rcar: Move R-Car reg definitions
  dt-bindings: usb: Document Renesas RZ/G3E USB3HOST
  usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  ...

Merge patch series "usb: gadget: Refactor function drivers to use __free() cleanup"

2025-09-17T10:44:55+00:00

Kuen-Han Tsai  says:

This patch series refactors the error-handling paths in the bind()
function for f_ncm, f_acm, f_ecm, and f_rndis drivers.

The current, unified goto logic in these drivers is vulnerable to a null
pointer dereference. This is caused by the cleanup logic incorrectly
handling the stale usb_request pointer after a bind/unbind cycle. This
series fixes this issue by converting the drivers to use the modern
__free() scope-based cleanup mechanism.

Patches 1-2 are preparatory, adding the endpoint pointer to struct
usb_request and defining helpers for the __free() cleanup. The remaining
four patches use this new plumbing to refactor each driver.

Future work
-----------
1. Refactor usb_ep_free_request(), usb_ep_queue(), and usb_ep_dequeue()
   functions as the ep parameter becomes redudant.
2. Convert the remaining gadget function drivers to use the new __free()
   cleanup mechanism.

Link: https://lore.kernel.org/r/20250916-ready-v1-0-4997bf277548@google.com
Signed-off-by: Greg Kroah-Hartman

usb: gadget: Introduce free_usb_request helper

2025-09-17T10:44:53+00:00

Introduce the free_usb_request() function that frees both the request's
buffer and the request itself.

This function serves as the cleanup callback for DEFINE_FREE() to enable
automatic, scope-based cleanup for usb_request pointers.

Signed-off-by: Kuen-Han Tsai 
Link: https://lore.kernel.org/r/20250916-ready-v1-2-4997bf277548@google.com
Signed-off-by: Greg Kroah-Hartman 
Link: https://lore.kernel.org/r/20250916-ready-v1-2-4997bf277548@google.com

usb: gadget: Store endpoint pointer in usb_request

2025-09-17T10:44:53+00:00

Gadget function drivers often have goto-based error handling in their
bind paths, which can be bug-prone. Refactoring these paths to use
__free() scope-based cleanup is desirable, but currently blocked.

The blocker is that usb_ep_free_request(ep, req) requires two
parameters, while the __free() mechanism can only pass a pointer to the
request itself.

Store an endpoint pointer in the struct usb_request. The pointer is
populated centrally in usb_ep_alloc_request() on every successful
allocation, making the request object self-contained.

Signed-off-by: Kuen-Han Tsai 
Link: https://lore.kernel.org/r/20250916-ready-v1-1-4997bf277548@google.com
Signed-off-by: Greg Kroah-Hartman 
Link: https://lore.kernel.org/r/20250916-ready-v1-1-4997bf277548@google.com

usb: typec: Stub out typec_switch APIs when CONFIG_TYPEC=n

2025-09-17T10:42:30+00:00

Ease driver development by adding stubs for the typec_switch APIs when
CONFIG_TYPEC=n. Copy the same method used for the typec_mux APIs to be
consistent.

Acked-by: Greg Kroah-Hartman 
Reviewed-by: Heikki Krogerus 
Signed-off-by: Stephen Boyd 
Signed-off-by: Xu Yang 
Link: https://lore.kernel.org/r/20250916021620.1303995-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman

media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE

2025-09-13T16:35:02+00:00

The ChromeOS XU provides a control to change the IQ profile for a camera.
It can be switched from VIVID (a.k.a. standard) to NONE (a.k.a. natural).

Wire it up to the standard v4l2 control.

Signed-off-by: Ricardo Ribalda 
Reviewed-by: Hans de Goede 
Signed-off-by: Hans de Goede 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil

media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header

2025-09-13T16:34:59+00:00

Move the MSXU_CONTROL_METADATA control definitino to the
include/linux/usb/uvc.h header, alongside the corresponding XU GUID. Add
a UVC_ prefix to avoid namespace clashes.

While at it, add the definition for the other controls for that
extension unit, as defined in
https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/uvc-extensions-1-5#222-extension-unit-controls.

Signed-off-by: Laurent Pinchart 
Reviewed-by: Ricardo Ribalda 
Reviewed-by: Hans de Goede 
Signed-off-by: Hans de Goede 
Signed-off-by: Hans Verkuil

Merge patch series "Support system sleep with offloaded usb transfers" into usb-next

2025-09-12T12:08:09+00:00

Guan-Yu Lin  says:

Wesley Cheng and Mathias Nyman's USB offload design enables a
co-processor to handle some USB transfers, potentially allowing the
system to sleep (suspend-to-RAM) and save power. However, Linux's System
Sleep model halts the USB host controller when the main system isn't
managing any USB transfers. To address this, the proposal modifies the
system to recognize offloaded USB transfers and manage power
accordingly. This way, offloaded USB transfers could still happen during
system sleep (Suspend-to-RAM).

This involves two key steps:
1. Transfer Status Tracking: Propose offload_usage and corresponding
   apis drivers could track USB transfers on the co-processor, ensuring
   the system is aware of any ongoing activity.
2. Power Management Adjustment:  Modifications to the USB driver stack
   (xhci host controller driver, and USB device drivers) allow the
   system to sleep (Suspend-to-RAM) without disrupting co-processor
   managed USB transfers. This involves adding conditional checks to
   bypass some power management operations in the System Sleep model.

Link: https://lore.kernel.org/r/20250911142051.90822-1-guanyulin@google.com
Signed-off-by: Greg Kroah-Hartman

xhci: sideband: add api to trace sideband usage

2025-09-12T12:08:02+00:00

The existing sideband driver only registers sidebands without tracking
their active usage. To address this, sideband will now record its active
usage when it creates/removes interrupters. In addition, a new api is
introduced to provide a means for other dirvers to fetch sideband
activity information on a USB host controller.

Signed-off-by: Guan-Yu Lin 
Link: https://lore.kernel.org/r/20250911142051.90822-4-guanyulin@google.com
Signed-off-by: Greg Kroah-Hartman 
Link: https://lore.kernel.org/r/20250911142051.90822-4-guanyulin@google.com