kernel/git/stable/linux.git/drivers/usb/chipidea, branch master

Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2026-08-25T17:44:46+00:00

Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1. Lots of driver work for new devices and systems, and many other minor fixes and updates. Included in here are: - Thunderbolt subsystem driver updates and additions - typec driver updates and additions - usb gadget fixes all over the place, seems like people are finally paying attention to these drivers for some reason - xhci driver updates and fixes based on lots of reports - usb-serial driver updates and additions - new device ids - other minor USB driver updates and fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits) usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() usb: typec: hd3ss3220: fix VBUS regulator error message usb: usbfs: fix use-after-free of usb_device in usbdev_release() usb: gadget: u_audio: Fix use-after-free on sound card disconnect usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition usb: gadget: f_tcm: keep port count until LUN teardown completes usb: usbtest: disable dynamic ID support usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() USB: c67x00: fix use-after-free in c67x00_add_iso_urb() usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion usb: gadget: snps_udc_plat: clean up PHY on probe deferral usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usb: dwc2: gadget: Exit partial power down state when changing USB pull-up usb: gadget: f_fs: Fix Use-After-Free in AIO error path usb: gadget: f_fs: Prevent deadlock during ep0 read loop usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed usb: gadget: midi2: remove default configfs groups on teardown usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() usb: typec: thunderbolt: Disable work before freeing tbt on remove usb: xhci: Handle bogus TRB pointers in Missed Service Error events ...

Merge tag 'v7.2-rc7' into driver-core-next

2026-08-09T23:20:05+00:00

We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich

Merge 7.2-rc5 into usb-next

2026-07-27T06:40:53+00:00

We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman

usb: chipidea: fix usage_count leak when autosuspend_delay is negative

2026-07-16T15:12:21+00:00

The probe() calls pm_runtime_use_autosuspend(), but remove() does not call pm_runtime_dont_use_autosuspend(). This can lead to a usage_count leak if autosuspend_delay is set to a negative value. The pm_runtime_use_autosuspend() also notes that it's important to undo this with pm_runtime_dont_use_autosuspend() at driver exit time. Fixes: 1f874edcb731 ("usb: chipidea: add runtime power management support") Cc: stable Assisted-by: Claude:claude-sonnet-4.6 Signed-off-by: Xu Yang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260716104126.2763454-1-xu.yang_2@oss.nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: use platform_device_set_of_node_from_dev()

2026-07-10T14:07:09+00:00

Ahead of reworking the reference counting logic for platform devices, encapsulate the assignment of the OF node from another device for dynamically allocated platform devices with the provided helper. Acked-by: Peter Chen Link: https://lore.kernel.org/r/20211215225646.1997946-1-robh@kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260706-pdev-fwnode-ref-v3-17-1ff028e33779@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: imx: fix missing ret assignment for dev_err_probe

2026-07-10T13:57:32+00:00

Assign the return value of dev_err_probe() to ret so that the correct error code is propagated when goto err_clk is taken. Fixes: 2e9762f45efb ("usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202607031656.FR3Xrved-lkp@intel.com/ Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260710070834.2744357-1-xu.yang_2@oss.nxp.com Signed-off-by: Greg Kroah-Hartman

Merge tag 'v7.1-rc6' into usb-next

2026-06-01T15:39:51+00:00

We need the USB and Thunderbolt fixes in here as well. Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: support dynamic gadget add/remove

2026-05-22T09:28:10+00:00

An asynchronous vbus_event_work() keep running when switch the role from device to host. This affects EHCI host controller initialization. USBCMD.RUNSTOP bit is set at ehci_run() and cleared by following vbus_event_work() if bus_event_work() run after ehci_run(). The log below shows what happens: [ 87.819925] ci_hdrc ci_hdrc.0: EHCI Host Controller [ 87.819963] ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1 [ 87.955634] ci_hdrc ci_hdrc.0: USB 2.0, controller refused to start: -110 [ 87.955658] ci_hdrc ci_hdrc.0: startup error -110 [ 87.955682] ci_hdrc ci_hdrc.0: USB bus 1 deregistered The problem is that the chipidea UDC driver call usb_udc_vbus_handler() to pull down data line but it don't wait for completion before host controller starts running. Now UDC core can properly delete usb gadget device and make sure that vbus work is cancelled or completed after usb_del_gadget_udc() is returned. But the udc.c only call usb_del_gadget_udc() in ci_hdrc_gadget_destroy(). To avoid above issue, add/remove the gadget device dynamically during USB role switching. To support dynamic gadget add/remove, do below steps: - clear ci->gadget and ci->ci_hw_ep at initialization. - assign udc_[start|stop]() to rdrv->[start|stop] and properly merge the operations in udc_id_switch_for_[device|host]() to udc_[start|stop]() Adjust the order ci_handle_vbus_change() and ci_role_start() to avoid NULL pointer reference since ci_hdrc_gadget_init() doesn't add gadget anymore. Acked-by: Peter Chen Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075653.3611180-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: add a helper ci_udc_enable_vbus_irq()

2026-05-22T09:28:10+00:00

The VBUS interrupt is configured in multiple places, add a helper function ci_udc_enable_vbus_irq() to simplify the code. Acked-by: Peter Chen Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075653.3611180-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: core: convert ci_role_switch to local variable

2026-05-22T09:20:56+00:00

When a system contains multiple USB controllers, the global ci_role_switch variable may be overwritten by subsequent driver initialization code. This can cause issues in the following cases: - The 2nd ci_hdrc_probe() sees ci_role_switch.fwnode as non-NULL even though the "usb-role-switch" property is not present for the controller. - When the ci_hdrc device is unbound and bound again, ci_role_switch fwnode will not be reassigned, and the old value will be used instead. Convert ci_role_switch to a local variable to fix these issues. Fixes: 05559f10ed79 ("usb: chipidea: add role switch class support") Cc: stable Acked-by: Peter Chen Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075755.3611217-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman