kernel/git/next/linux-next.git/drivers/usb/dwc2, branch master

Merge branch 'usb-next' of https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git

2026-09-18T12:33:32+00:00

usb: dwc2: fix typos in comments

2026-09-10T15:10:12+00:00

Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Link: https://patch.msgid.link/20260904105555.37215-1-hemanth.selam@gmail.com Signed-off-by: Greg Kroah-Hartman

USB: dwc2: shut down wakeup timer before freeing HCD state

2026-09-10T15:08:19+00:00

dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal. Fixes: 7359d482eb4d ("staging: HCD files for the DWC2 driver") Cc: stable Assisted-by: Codex:GPT-5 Signed-off-by: Runyu Xiao Reviewed-by: Thinh Nguyen Link: https://patch.msgid.link/20260904065323.4047026-1-runyu.xiao@seu.edu.cn Signed-off-by: Greg Kroah-Hartman

usb: dwc2: debugfs: fix memory leak of hsotg->regset

2026-09-10T13:42:17+00:00

hsotg->regset is allocated in dwc2_debugfs_init() using devm_kzalloc(), which ties its lifetime to the device (struct dwc2_hsotg) rather than to the debugfs entries it serves. dwc2_debugfs_exit() removes the debugfs directory but leaves hsotg->regset allocated until the device itself is removed, so the pointer dangles for the remainder of the device lifetime. Switch to kzalloc() and free it explicitly in dwc2_debugfs_exit() so the regset lifetime matches the debugfs lifetime. Set the pointer to NULL after freeing to avoid a stale dangling pointer. Reported-by: kakapapa2 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219977 Reviewed-by: Thinh Nguyen Signed-off-by: Huang Wei Link: https://patch.msgid.link/20260909021014.906548-1-huangwei@kylinos.cn Signed-off-by: Greg Kroah-Hartman

usb: dwc2: truncate PIO RX FIFO reads to the request's remaining space

2026-09-10T13:42:14+00:00

dwc2_hsotg_rx_data() reads the OUT packet length from the RX FIFO status (GRXSTS.BYTECNT, host-controlled) and, when it exceeds the remaining space of the active gadget request (max_req = req.length - req.actual), merely fires WARN_ON_ONCE(1) and then stores the whole packet into hs_req->req.buf + req->req.actual via dwc2_readl_rep(): req.actual += size; dwc2_readl_rep(hsotg, EPFIFO(ep_idx), req.buf + actual, DIV_ROUND_UP(size, 4)); A packet larger than the request buffer therefore over-writes up to maxpacket bytes past it. The rounded-up word read additionally emits up to 3 bytes past the logical end even when the size does not exceed the remaining space (short-request boundary). Attack chain (USB peripheral/gadget mode, PIO only; the attacker is the USB host): malicious host -> OUT packet on epN -> RX FIFO interrupt -> dwc2_hsotg_handle_rx() (GRXSTS_PKTSTS_OUTRX / SETUPRX) -> dwc2_hsotg_rx_data(hsotg, epnum, BYTECNT=64) with the queued request having req.length=8, req.actual=7 (1 byte left) -> "to_read(64) > max_req(1)" -> WARN_ON_ONCE(1) only -> dwc2_readl_rep() writes 16 words at req.buf+7 -> 63 bytes past the 8-byte request buffer Reproduced (kernel 7.2.0+, KASAN/SLUB debug): calling the real dwc2_hsotg_rx_data() with the above state (request buffer 8 bytes, actual 7, size 64) triggers the WARN and leaves req.actual = 71 (the 64 bytes are accrued regardless), and the SLUB redzone immediately after the 8-byte object plus neighbouring slab objects are overwritten with FIFO content (byte 7 changes from a marker to FIFO data) - the out-of-bounds write is visible byte-for-byte. The FIFO read is done by raw 32-bit I/O words, which generic KASAN does not instrument, so the redzone/neighbour clobber is the forensic evidence. Signed-off-by: Haofeng Li Assisted-by: opencode:deepseek-v4-flash-free Link: https://patch.msgid.link/20260826133401.3796639-1-lihaofeng@kylinos.cn Signed-off-by: Greg Kroah-Hartman

usb: dwc2: handle OTG HNP SetFeature requests

2026-09-10T13:42:12+00:00

Without handling for b_hnp_enable, a_hnp_support, and a_alt_hnp_support, HNP cannot be enabled when two OTG controllers are connected. Handle SetFeature for these OTG selectors, gated on otg_caps.hnp_support. The OTG specification only defines SetFeature for them, so reject ClearFeature with -EINVAL instead of silently accepting it. Use dev_dbg for status updates to avoid noisy logs. Advertise the core's HNP/SRP capability during gadget init by restoring GUSBCFG_HNPCAP/SRPCAP from otg_caps, mirroring dwc2_gusbcfg_init() on the host side, instead of clearing them unconditionally. Clear the HNP flags and GOTGCTL_DEVHNPEN on disconnect/reset so OTG state does not leak across sessions. Signed-off-by: Adrian Ng Ho Yin Signed-off-by: Tze Yee Ng Link: https://patch.msgid.link/e1f4718cadf28c4348bcf6ebb025f71732416538.1786950594.git.tze.yee.ng@altera.com Signed-off-by: Greg Kroah-Hartman

usb: dwc2: gadget: Remove redundant dev_err()

2026-09-01T14:27:29+00:00

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang Link: https://patch.msgid.link/20260731035448.252289-4-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman

usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

2026-08-14T01:48:41+00:00

When a USB host suspends a connected device, the DWC2 USB device controller enters a partial power down state where controller registers are not accessible. If the USB gadget is then disconnected or deactivated (e.g. when a gadget function is unbound from the controller), the `pullup` callback in struct usb_gadget_ops is invoked; if the controller is kept in partial power down, the register write in dwc2_hsotg_core_disconnect() does not take effect; as a result, the USB host keeps seeing the device as connected, even though the device is disabled. Properly exit partial power down state in the pullup callback, so that the USB host detects a device disconnection as intended. Fixes: 97861781daff ("usb: dwc2: Allow entering hibernation from USB_SUSPEND interrupt") Cc: stable@vger.kernel.org Signed-off-by: Francesco Lavra Link: https://patch.msgid.link/20260728154420.2021519-1-flavra@baylibre.com Signed-off-by: Greg Kroah-Hartman

Merge 7.2-rc3 into usb-next

2026-07-13T05:09:28+00:00

We need the USB fixes in here as well to build on top of. Signed-off-by: Greg Kroah-Hartman

usb: dwc2: add missing @remotewakeup kernel-doc parameter

2026-07-10T13:56:06+00:00

Add the @remotewakeup kernel-doc parameter description to the dwc2_wakeup_from_lpm_l1() function. Fixes: 5d69a3b54e5a ("usb: dwc2: gadget: LPM flow fix") Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260604000513.15753-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman