[GIT PULL] USB driver fixes for 7.1-rc6
From: Greg KH
Date: Sat May 30 2026 - 07:30:52 EST
The following changes since commit 5d6919055dec134de3c40167a490f33c74c12581:
Linux 7.1-rc3 (2026-05-10 14:08:09 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git tags/usb-7.1-rc6
for you to fetch changes up to 645d4eda1d0db0202ed8e4a2c3abb2ebce6b86ef:
Merge tag 'usb-serial-7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus (2026-05-23 13:21:56 +0200)
----------------------------------------------------------------
USB and Thunderbolt fixes for 7.1-rc6
Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing
major in here, just lots of tiny fixes for reported issues found by
users and some older patches found by some scanning tools. Included in
here are:
- typec fixes found by fuzzers that have decided to finally look at
that device interaction path (i.e. before a driver is bound to a
device).
- typec fixes for issues found by users
- thunderbolt driver fixes for reported problems
- cdns3 driver fixes
- dwc3 driver fixes
- new device quirks added
- usb serial driver fixes for broken devices
- other small driver fixes
All of these have been in linux-next for over a week with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
----------------------------------------------------------------
Dan Carpenter (2):
usb: typec: tipd: Fix error code in tps6598x_probe()
usb: dwc2: Fix use after free in debug code
Felix Gu (1):
usb: typec: fusb302: Fix resource leak when devm_drm_dp_hpd_bridge_add() fails
Greg Kroah-Hartman (10):
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
Merge tag 'thunderbolt-for-v7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
usb: typec: altmodes/displayport: validate count before reading Status Update VDO
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
usb: typec: ucsi: validate connector number in ucsi_connector_change()
Merge tag 'usb-serial-7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Guangshuo Li (2):
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
usb: gadget: net2280: Fix double free in probe error path
Hang Cao (1):
dt-bindings: usb: Fix EIC7700 USB reset's issue
Heitor Alves de Siqueira (2):
usb: usbtmc: check URB actual_length for interrupt-IN notifications
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
Jan Volckaert (1):
USB: serial: option: add MeiG SRM813Q
Jeremy Erazo (1):
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Johan Hovold (8):
USB: serial: digi_acceleport: fix memory corruption with small endpoints
USB: serial: keyspan: fix missing indat transfer sanity check
USB: serial: mct_u232: fix memory corruption with small endpoint
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
USB: serial: cypress_m8: fix memory corruption with small endpoint
USB: serial: mxuport: fix memory corruption with small endpoint
USB: serial: omninet: fix memory corruption with small endpoint
USB: serial: safe_serial: fix memory corruption with small endpoint
Kai Aizen (1):
usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
Michael Bommarito (6):
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
usb: gadget: f_fs: copy only received bytes on short ep0 read
usb: gadget: f_fs: serialize DMABUF cancel against request completion
Michal Pecio (3):
usb: core: Fix SuperSpeed root hub wMaxPacketSize
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
usb: core: Clean up SuperSpeed/eUSB2 descriptor validation logging
Myrrh Periwinkle (2):
usb: typec: ucsi: Check if power role change actually happened before handling
usb: typec: ucsi: Don't update power_supply on power role change if not connected
Peter Chen (2):
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
Radhey Shyam Pandey (1):
usb: dwc3: xilinx: fix error handling in zynqmp init error paths
Rob Herring (Arm) (1):
dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints
Sam Burkels (1):
usb: storage: Add quirks for PNY Elite Portable SSD
Sebastian Reichel (1):
usb: typec: tcpm: improve handling of DISCOVER_MODES failures
Seungjin Bae (1):
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
Stephen J. Fuhry (1):
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
Wanquan Zhong (1):
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
Wei-Cheng Chen (1):
xhci: tegra: Fix ghost USB device on dual-role port unplug
Wentao Guan (1):
USB: cdc-acm: Fix bit overlap and move quirk definitions to header
Wentao Liang (1):
usb: musb: omap2430: Fix use-after-free in omap2430_probe()
Xu Yang (1):
usb: chipidea: core: convert ci_role_switch to local variable
Yongchao Wu (1):
usb: cdns3: gadget: fix request skipping after clearing halt
Zhang Cen (2):
USB: serial: belkin_sa: validate interrupt status length
USB: serial: cypress_m8: validate interrupt packet headers
.../devicetree/bindings/usb/eswin,eic7700-usb.yaml | 7 +-
.../devicetree/bindings/usb/ti,omap4-musb.yaml | 7 +-
drivers/thunderbolt/property.c | 32 ++++--
drivers/usb/cdns3/cdns3-gadget.c | 12 ++-
drivers/usb/cdns3/cdns3-plat.c | 11 +-
drivers/usb/chipidea/core.c | 16 ++-
drivers/usb/class/cdc-acm.c | 2 -
drivers/usb/class/cdc-acm.h | 2 +
drivers/usb/class/usbtmc.c | 14 +++
drivers/usb/core/config.c | 46 ++++----
drivers/usb/core/hcd.c | 4 +-
drivers/usb/core/quirks.c | 4 +
drivers/usb/dwc2/hcd.c | 4 +-
drivers/usb/dwc3/dwc3-xilinx.c | 27 ++---
drivers/usb/gadget/composite.c | 5 +-
drivers/usb/gadget/function/f_fs.c | 26 ++++-
drivers/usb/gadget/function/f_hid.c | 3 +-
drivers/usb/gadget/function/f_uvc.c | 28 +++--
drivers/usb/gadget/udc/dummy_hcd.c | 4 +
drivers/usb/gadget/udc/net2280.c | 4 +-
drivers/usb/host/xhci-tegra.c | 71 +++++++------
drivers/usb/musb/omap2430.c | 3 +-
drivers/usb/serial/belkin_sa.c | 3 +
drivers/usb/serial/cypress_m8.c | 20 +++-
drivers/usb/serial/digi_acceleport.c | 23 +++-
drivers/usb/serial/keyspan.c | 4 +
drivers/usb/serial/mct_u232.c | 26 +++--
drivers/usb/serial/mxuport.c | 8 ++
drivers/usb/serial/omninet.c | 9 +-
drivers/usb/serial/option.c | 9 +-
drivers/usb/serial/safe_serial.c | 11 ++
drivers/usb/storage/unusual_uas.h | 7 ++
drivers/usb/typec/altmodes/displayport.c | 2 +
drivers/usb/typec/tcpm/fusb302.c | 20 ++--
drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 ++
drivers/usb/typec/tcpm/tcpm.c | 117 +++++++++++++--------
drivers/usb/typec/tcpm/wcove.c | 13 ++-
drivers/usb/typec/tipd/core.c | 1 +
drivers/usb/typec/ucsi/displayport.c | 4 +
drivers/usb/typec/ucsi/ucsi.c | 24 ++++-
drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +
drivers/usb/usbip/vudc_dev.c | 1 +
drivers/usb/usbip/vudc_transfer.c | 3 +-
43 files changed, 445 insertions(+), 206 deletions(-)