[GIT PULL] USB serial fixes for 7.4-rc1

[Johan Hovold]

The following changes since commit c339f4010dea8b0d754f84ace70cd1b089878ef8:

  Merge tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 (2026-10-28 07:36:32 -1000)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial.git tags/usb-serial-7.4-rc1-2

for you to fetch changes up to ab89a9dab02d9553eb0cc27fd3e4a4998acbc8e9:

  USB: serial: garmin_gps: fix deadlock on reset request (2026-10-29 16:26:41 +0100)

----------------------------------------------------------------
USB serial fixes for 7.4-rc1

Here are a number of fixes for issues hit by syzbot, flagged by Sashiko
or LLM audits, or found through inspection:

 - fix NULL-deref on upd78f0730 hangup (including disconnect)
 - fix OOB read or NULL-deref in garmin_gps on crafted write()
 - fix deadlock on garmin_gps write() reset request
 - fix NULL-deref on early io_edgeport status
 - fix UAF on io_edgeport close() race
 - fix NULL-deref on io_edgeport open() race
 - fix io_edgeport fifo corruption on stray open response
 - fix UAF on io_edgeport disconnect
 - fix missing io_edgeport MCR locking
 - fix oti6858 teardown order to avoid open failure and disconnect UAF
 - fix OOB read on short sierra interrupt message

Everything has been in linux-next over night and with no reported
issues.

----------------------------------------------------------------
Hui Peng (1):
      USB: serial: garmin_gps: validate packet data length in nat_receive()

Johan Hovold (9):
      USB: serial: upd78f0730: fix NULL-deref on hangup
      USB: serial: io_edgeport: fix NULL-deref on early status
      USB: serial: io_edgeport: fix potential close() use-after-free
      USB: serial: io_edgeport: fix potential NULL-deref at open
      USB: serial: io_edgeport: move initial termios update to open()
      USB: serial: io_edgeport: fix potential fifo corruption
      USB: serial: io_edgeport: fix potential use-after-free on disconnect
      USB: serial: io_edgeport: serialise MCR accesses
      USB: serial: garmin_gps: fix deadlock on reset request

Josef Bacik (1):
      USB: serial: oti6858: fix the teardown order in close

Tristan Madani (1):
      USB: serial: sierra: validate URB length in instat callback

 drivers/usb/serial/garmin_gps.c  |  31 +++++----
 drivers/usb/serial/io_edgeport.c | 141 +++++++++++++++++----------------------
 drivers/usb/serial/oti6858.c     |  16 +++--
 drivers/usb/serial/sierra.c      |  18 ++++-
 drivers/usb/serial/upd78f0730.c  |  13 ++--
 5 files changed, 114 insertions(+), 105 deletions(-)