kernel/git/stable/linux.git/drivers/usb/dwc2, branch master

usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

2026-08-14T01:48:41+00:00

When a USB host suspends a connected device, the DWC2 USB device controller enters a partial power down state where controller registers are not accessible. If the USB gadget is then disconnected or deactivated (e.g. when a gadget function is unbound from the controller), the `pullup` callback in struct usb_gadget_ops is invoked; if the controller is kept in partial power down, the register write in dwc2_hsotg_core_disconnect() does not take effect; as a result, the USB host keeps seeing the device as connected, even though the device is disabled. Properly exit partial power down state in the pullup callback, so that the USB host detects a device disconnection as intended. Fixes: 97861781daff ("usb: dwc2: Allow entering hibernation from USB_SUSPEND interrupt") Cc: stable@vger.kernel.org Signed-off-by: Francesco Lavra Link: https://patch.msgid.link/20260728154420.2021519-1-flavra@baylibre.com Signed-off-by: Greg Kroah-Hartman

Merge 7.2-rc3 into usb-next

2026-07-13T05:09:28+00:00

We need the USB fixes in here as well to build on top of. Signed-off-by: Greg Kroah-Hartman

usb: dwc2: add missing @remotewakeup kernel-doc parameter

2026-07-10T13:56:06+00:00

Add the @remotewakeup kernel-doc parameter description to the dwc2_wakeup_from_lpm_l1() function. Fixes: 5d69a3b54e5a ("usb: dwc2: gadget: LPM flow fix") Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260604000513.15753-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: dwc2: Add include defining struct pci_device_id

2026-07-03T05:38:15+00:00

Up to now includes that provides struct pci_device_id. However was split into per bus headers and will only include the acpi related one (and similar for other bus headers). As struct pci_device_id is used in drivers/usb/dwc2/core.h, add an include to ensure it's defined also after the includes in are tightened. Acked-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/bddfcdfaf36d735c244e03efada6083ef98ebd51.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub)

Merge tag 'v7.1-rc6' into usb-next

2026-06-01T15:39:51+00:00

We need the USB and Thunderbolt fixes in here as well. Signed-off-by: Greg Kroah-Hartman

usb: dwc2: remove WARN in dwc2_hcd_save_data_toggle

2026-05-22T09:35:56+00:00

The WARN() in dwc2_hcd_save_data_toggle() was introduced in commit 62943b7dfa35 ("usb: dwc2: host: fix the data toggle error in full speed descriptor dma"), it looks like the WARN() is to ensure proper usage of dwc2_hcd_save_data_toggle(): either qtd is provided for control eps or qh is provided for non-control eps. This check is good even if there's no such improper usage in current code. But the WARN() usage in driver is discouraged nowadays: imagine there is an improper usage, then kernel panic due to warn if 'panic_on_warn' is enabled. While emitting the err msg for improper usage is still valueable, so let's replace the WARN with check and dev_err(). At the same time, it looks a bit strange we check !chan after dereference of this pointer with "if (chan->ep_type != USB_ENDPOINT_XFER_CONTROL)". In fact, when entering the dwc2_hcd_save_data_toggle(), the chan won't be NULL, because its caller or indirect caller has ensured this, specifically, it's checked with below line in dwc2_hc_n_intr() if (!chan) { dev_err(hsotg->dev, "## hc_ptr_array for channel is NULL ##\n"); return; } This addresses the following issue reported by klocwork tool: - Suspicious dereference of pointer 'chan' before NULL check at line 518 Suggested-by: Greg Kroah-Hartman Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20260520133711.14410-1-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman

usb: dwc2: Fix use after free in debug code

2026-05-22T09:21:07+00:00

We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time. Fixes: 7359d482eb4d ("staging: HCD files for the DWC2 driver") Cc: stable Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/ag1NwBpqT4IEQcdJ@stanley.mountain Signed-off-by: Greg Kroah-Hartman

usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()

2026-03-30T15:05:07+00:00

dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, which expects hsotg->lock to be held since it does spin_unlock/spin_lock around the gadget driver callback invocation. However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() without holding the lock. This leads to: - spin_unlock on a lock that is not held (undefined behavior) - The lock remaining held after dwc2_gadget_exit_clock_gating() returns, causing a deadlock when spin_lock_irqsave() is called later in the same function. Fix this by acquiring hsotg->lock before calling dwc2_gadget_exit_clock_gating() and releasing it afterwards, which satisfies the locking requirement of the call_gadget() macro. Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended") Cc: stable Signed-off-by: Juno Choi Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook