linux.git/drivers/usb/class, branch v6.18.21 Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git usb: class: cdc-wdm: fix reordering issue in read code path 2026-03-19T15:08:27+00:00 Oliver Neukum oneukum@suse.com 2026-03-04T13:01:12+00:00 67ed312124bb1b61858778ac0b985b48961c862a commit 8df672bfe3ec2268c2636584202755898e547173 upstream. Quoting the bug report: Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdm_read() can see the new length and call copy_to_user() on uninitialized memory. This also violates LKMM data race rules [1]. Fix it by using WRITE_ONCE and memory barriers. Fixes: afba937e540c9 ("USB: CDC WDM driver") Cc: stable <stable@kernel.org> Signed-off-by: Oliver Neukum <oneukum@suse.com> Closes: https://lore.kernel.org/linux-usb/CALbr=LbrUZn_cfp7CfR-7Z5wDTHF96qeuM=3fO2m-q4cDrnC4A@mail.gmail.com/ Reported-by: Gui-Dong Han <hanguidong02@gmail.com> Reviewed-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://patch.msgid.link/20260304130116.1721682-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 8df672bfe3ec2268c2636584202755898e547173 upstream.

Quoting the bug report:

Due to compiler optimization or CPU out-of-order execution, the
desc->length update can be reordered before the memmove. If this
happens, wdm_read() can see the new length and call copy_to_user() on
uninitialized memory. This also violates LKMM data race rules [1].

Fix it by using WRITE_ONCE and memory barriers.

Fixes: afba937e540c9 ("USB: CDC WDM driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Closes: https://lore.kernel.org/linux-usb/CALbr=LbrUZn_cfp7CfR-7Z5wDTHF96qeuM=3fO2m-q4cDrnC4A@mail.gmail.com/
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://patch.msgid.link/20260304130116.1721682-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts 2026-03-19T15:08:26+00:00 Alan Stern stern@rowland.harvard.edu 2026-02-18T03:09:22+00:00 6cb7dc91f057dd8ce44f6caa2995d8e22784ed0a commit 7784caa413a89487dd14dd5c41db8753483b2acb upstream. The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usb_bulk_msg() calls. Since the user can specify arbitrarily long timeouts and usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable() instead to avoid the possibility of the user hanging a kernel thread indefinitely. Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout") CC: stable@vger.kernel.org Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 7784caa413a89487dd14dd5c41db8753483b2acb upstream.

The usbtmc driver accepts timeout values specified by the user in an
ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
Since the user can specify arbitrarily long timeouts and
usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
instead to avoid the possibility of the user hanging a kernel thread
indefinitely.

Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: cdc-acm: Restore CAP_BRK functionnality to CH343 2026-03-19T15:08:26+00:00 Marc Zyngier maz@kernel.org 2026-03-01T12:44:40+00:00 9459b5731cd8b68b04c91316f71c2377162bfb2b commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef upstream. The CH343 USB/serial adapter is as buggy as it is popular (very). One of its quirks is that despite being capable of signalling a BREAK condition, it doesn't advertise it. This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break") applied some reasonable restrictions, preventing breaks from being emitted on devices that do not advertise CAP_BRK. Add a quirk for this particular device, so that breaks can still be produced on some of my machines attached to my console server. Fixes: 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break") Signed-off-by: Marc Zyngier <maz@kernel.org> Cc: stable <stable@kernel.org> Cc: Oliver Neukum <oneukum@suse.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20260301124440.1192752-1-maz@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef upstream.

The CH343 USB/serial adapter is as buggy as it is popular (very).
One of its quirks is that despite being capable of signalling a
BREAK condition, it doesn't advertise it.

This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm:
return correct error code on unsupported break") applied some
reasonable restrictions, preventing breaks from being emitted on
devices that do not advertise CAP_BRK.

Add a quirk for this particular device, so that breaks can still
be produced on some of my machines attached to my console server.

Fixes: 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable <stable@kernel.org>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260301124440.1192752-1-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: usblp: Use min_t() to improve usblp_read() 2025-09-06T13:20:22+00:00 Thorsten Blum thorsten.blum@linux.dev 2025-08-29T17:37:12+00:00 43ae982cd0ec7fb6fea40fabef2c872e6f9b213d Use min_t() to improve usblp_read() and avoid calculating 'avail - usblp->readcount' twice. Use min_t(ssize_t,,) instead of min() to avoid a signedness error. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250829173713.56222-1-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Use min_t() to improve usblp_read() and avoid calculating
'avail - usblp->readcount' twice. Use min_t(ssize_t,,) instead of min()
to avoid a signedness error.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://lore.kernel.org/r/20250829173713.56222-1-thorsten.blum@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2025-07-29T17:17:10+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-07-29T17:17:10+00:00 4eee1520ea845a6d6d82e85498d9412419560871 Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver changes for 6.17-rc1. Lots of little things in here, mostly all small cleanups and updates, no major new features this development cycle. Stuff included in here is: - xhci minor tweaks for error handling - typec minor updates and a driver update - gadget driver api cleanups - unused function removals - unbind memory leak fixes - a few new device ids added - a few new devices supported for some drivers - other minor cleanups and changes All of these have been in linux-next with no reported issues, with the leak fixes being in the shortest amount of time, but they are 'obviously correct' :)" * tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (100 commits) usb: musb: omap2430: clean up probe error handling usb: musb: omap2430: fix device leak at unbind usb: gadget: udc: renesas_usb3: fix device leak at unbind usb: dwc3: meson-g12a: fix device leaks at unbind usb: dwc3: imx8mp: fix device leak at unbind usb: musb: omap2430: enable compile testing usb: gadget: udc: renesas_usb3: drop unused module alias usb: xhci: print xhci->xhc_state when queue_command failed usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() USB: serial: option: add Foxconn T99W709 usb: core: add urb->sgt parameter description thunderbolt: Fix copy+paste error in match_service_id() usb: typec: ucsi: Update power_supply on power role change usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default usb: typec: fusb302: cache PD RX state usb: typec: ucsi: yoga-c630: add DRM dependency usb: gadget : fix use-after-free in composite_dev_cleanup() usb: chipidea: imx: Add a missing blank line usb: gadget: f_uac1: replace scnprintf() with sysfs_emit() usb: usblp: clean up assignment inside if conditions ... 
Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for
  6.17-rc1.

  Lots of little things in here, mostly all small cleanups and updates,
  no major new features this development cycle. Stuff included in here
  is:

   - xhci minor tweaks for error handling

   - typec minor updates and a driver update

   - gadget driver api cleanups

   - unused function removals

   - unbind memory leak fixes

   - a few new device ids added

   - a few new devices supported for some drivers

   - other minor cleanups and changes

  All of these have been in linux-next with no reported issues, with the
  leak fixes being in the shortest amount of time, but they are
  'obviously correct' :)"

* tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (100 commits)
  usb: musb: omap2430: clean up probe error handling
  usb: musb: omap2430: fix device leak at unbind
  usb: gadget: udc: renesas_usb3: fix device leak at unbind
  usb: dwc3: meson-g12a: fix device leaks at unbind
  usb: dwc3: imx8mp: fix device leak at unbind
  usb: musb: omap2430: enable compile testing
  usb: gadget: udc: renesas_usb3: drop unused module alias
  usb: xhci: print xhci->xhc_state when queue_command failed
  usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  USB: serial: option: add Foxconn T99W709
  usb: core: add urb->sgt parameter description
  thunderbolt: Fix copy+paste error in match_service_id()
  usb: typec: ucsi: Update power_supply on power role change
  usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  usb: typec: fusb302: cache PD RX state
  usb: typec: ucsi: yoga-c630: add DRM dependency
  usb: gadget : fix use-after-free in composite_dev_cleanup()
  usb: chipidea: imx: Add a missing blank line
  usb: gadget: f_uac1: replace scnprintf() with sysfs_emit()
  usb: usblp: clean up assignment inside if conditions
  ...
usb: usblp: clean up assignment inside if conditions 2025-07-21T14:30:54+00:00 Darshan Rathod darshan.rathod@siqol.com 2025-07-18T09:10:45+00:00 d8e1ecffb4a282791be1b3d81a05541749b0db64 This patch cleans up a few cases where assignments were made inside of if conditions, like if ((rv = func()) < 0) into two lines, to improve readability and be more in-line with Linux kernel coding style. It also cleans up checkpatch warnings like: ERROR: do not use assignment in if condition No functional change, just a style and maintainability fix. Signed-off-by: Darshan Rathod <darshan.rathod@siqol.com> Link: https://lore.kernel.org/r/20250718091045.264129-1-darshan.rathod@siqol.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This patch cleans up a few cases where assignments were made
inside of if conditions, like

if ((rv = func()) < 0)

into two lines, to improve readability and be more in-line with
Linux kernel coding style. It also cleans up checkpatch warnings
like:

ERROR: do not use assignment in if condition

No functional change, just a style and maintainability fix.

Signed-off-by: Darshan Rathod <darshan.rathod@siqol.com>
Link: https://lore.kernel.org/r/20250718091045.264129-1-darshan.rathod@siqol.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cdc-acm: fix race between initial clearing halt and open 2025-07-21T14:29:44+00:00 Oliver Neukum oneukum@suse.com 2025-07-17T14:12:50+00:00 64690a90cd7c6db16d3af8616be1f4bf8d492850 On the devices that need their endpoints to get an initial clear_halt, this needs to be done before the devices can be opened. That means it needs to be before the devices are registered. Fixes: 15bf722e6f6c0 ("cdc-acm: Add support of ATOL FPrint fiscal printers") Cc: stable <stable@kernel.org> Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://lore.kernel.org/r/20250717141259.2345605-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
On the devices that need their endpoints to get an
initial clear_halt, this needs to be done before
the devices can be opened. That means it needs to be
before the devices are registered.

Fixes: 15bf722e6f6c0 ("cdc-acm: Add support of ATOL FPrint fiscal printers")
Cc: stable <stable@kernel.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20250717141259.2345605-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
tty: introduce and use tty_port_tty_vhangup() helper 2025-06-17T11:42:33+00:00 Jiri Slaby (SUSE) jirislaby@kernel.org 2025-06-11T10:02:47+00:00 2b5eac0f8c6e79bc152c8804f9f88d16717013ab This code (tty_get -> vhangup -> tty_put) is repeated on few places. Introduce a helper similar to tty_port_tty_hangup() (asynchronous) to handle even vhangup (synchronous). And use it on those places. In fact, reuse the tty_port_tty_hangup()'s code and call tty_vhangup() depending on a new bool parameter. Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: David Lin <dtwlin@gmail.com> Cc: Johan Hovold <johan@kernel.org> Cc: Alex Elder <elder@kernel.org> Cc: Oliver Neukum <oneukum@suse.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20250611100319.186924-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This code (tty_get -> vhangup -> tty_put) is repeated on few places.
Introduce a helper similar to tty_port_tty_hangup() (asynchronous) to
handle even vhangup (synchronous).

And use it on those places.

In fact, reuse the tty_port_tty_hangup()'s code and call tty_vhangup()
depending on a new bool parameter.

Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: David Lin <dtwlin@gmail.com>
Cc: Johan Hovold <johan@kernel.org>
Cc: Alex Elder <elder@kernel.org>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20250611100319.186924-2-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: usbtmc: Fix timeout value in get_stb 2025-05-21T13:01:09+00:00 Dave Penkler dpenkler@gmail.com 2025-05-21T12:16:56+00:00 342e4955a1f1ce28c70a589999b76365082dbf10 wait_event_interruptible_timeout requires a timeout argument in units of jiffies. It was being called in usbtmc_get_stb with the usb timeout value which is in units of milliseconds. Pass the timeout argument converted to jiffies. Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout") Cc: stable@vger.kernel.org Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250521121656.18174-4-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
wait_event_interruptible_timeout requires a timeout argument
in units of jiffies. It was being called in usbtmc_get_stb
with the usb timeout value which is in units of milliseconds.

Pass the timeout argument converted to jiffies.

Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250521121656.18174-4-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: usbtmc: Fix read_stb function and get_stb ioctl 2025-05-21T13:01:09+00:00 Dave Penkler dpenkler@gmail.com 2025-05-21T12:16:55+00:00 acb3dac2805d3342ded7dbbd164add32bbfdf21c The usbtmc488_ioctl_read_stb function relied on a positive return from usbtmc_get_stb to reset the srq condition in the driver. The USBTMC_IOCTL_GET_STB case tested for a positive return to return the stb to the user. Commit: <cac01bd178d6> ("usb: usbtmc: Fix erroneous get_stb ioctl error returns") changed the return value of usbtmc_get_stb to 0 on success instead of returning the value of usb_control_msg which is positive in the normal case. This change caused the function usbtmc488_ioctl_read_stb and the USBTMC_IOCTL_GET_STB ioctl to no longer function correctly. Change the test in usbtmc488_ioctl_read_stb to test for failure first and return the failure code immediately. Change the test for the USBTMC_IOCTL_GET_STB ioctl to test for 0 instead of a positive value. Fixes: cac01bd178d6 ("usb: usbtmc: Fix erroneous get_stb ioctl error returns") Cc: stable@vger.kernel.org Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250521121656.18174-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The usbtmc488_ioctl_read_stb function relied on a positive return from
usbtmc_get_stb to reset the srq condition in the driver. The
USBTMC_IOCTL_GET_STB case tested for a positive return to return the stb
to the user.

Commit: <cac01bd178d6> ("usb: usbtmc: Fix erroneous get_stb ioctl
error returns") changed the return value of usbtmc_get_stb to 0 on
success instead of returning the value of usb_control_msg which is
positive in the normal case. This change caused the function
usbtmc488_ioctl_read_stb and the USBTMC_IOCTL_GET_STB ioctl to no
longer function correctly.

Change the test in usbtmc488_ioctl_read_stb to test for failure
first and return the failure code immediately.
Change the test for the USBTMC_IOCTL_GET_STB ioctl to test for 0
instead of a positive value.

Fixes: cac01bd178d6 ("usb: usbtmc: Fix erroneous get_stb ioctl error returns")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250521121656.18174-3-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>