Pull USB / Thunderbolt update from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 7.4-rc1.
  Included in here are:

   - thunderbolt driver updates and fixes

   - lots of dt schema conversions

   - usb gadget driver fixes (and a new maintainer!)

   - usb core fixups with some interactions with the driver core

   - usb serial updates and fixes for scan-found "issues"

   - xhci driver updates

   - typec driver updates

   - dwc3 driver updates

   - lots of usb gadget driver fixes for syzbot found "problems"

   - lots of other small USB driver fixes for randomly reported problems.

  All of these have been in linux-next with no reported issues"

* tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (158 commits)
  usb: gadget: dummy_hcd: prevent unbind via sysfs
  usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning
  usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus
  usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket
  usb: gadget: fix refcount underflow in gadgetfs_bind() error path
  USB: core: document purpose of interface parent reference
  MAINTAINERS: add Neill Kapron as USB Gadget maintainer
  USB: Documentation: Update description of completion callback context
  USB: serial: mxuport: support RS485 mode configuration
  USB: serial: mxuport: handle SEND_NEXT transmit flow control
  USB: serial: add generic write control callbacks
  USB: serial: mxuport: add MUX50U-based device support
  USB: serial: mxuport: clean up firmware version handling
  USB: serial: mxuport: clean up product ID definitions and device table
  USB: serial: sierra: fix urb leak on write completion
  usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
  usb: host: xhci-tegra: Add Tegra264 XHCI support
  usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264
  dt-bindings: usb: Add Tegra264 XUSB host support
  usb: xhci-pci: Add TUSB73x0 definitions
  ...

Pull SCSI updates from James Bottomley:
 "Small number of driver updates (mpi3mr, ufs, scsi_debug).

  By far the biggest core change (at 4000+ lines) is the sense code
  rework to make our sense handling follow the 16 bit defines in the
  SCSI standard rather than our split ASC and ASCQ handling which ends
  up being confusing and difficult to grep.

  The changes should all be functionally equivalent and so far the bots
  and AI seem to agree; the code has been incubating in -next since 16
  September with one reported issue fixed.

  The remaining updates are minor"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (114 commits)
  scsi: ufs: rpmb: Fix power-on UNIT ATTENTION retry
  scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init()
  scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init()
  scsi: MAINTAINERS: Remove Avri Altman as UFS reviewer
  scsi: st: Relock the door after a reset
  scsi: st: Restore the drive buffering mode after reset
  scsi: st: Record the tape position after a successful MTLOAD
  scsi: st: Restore changed drive settings after reset also for MTLOAD and MTRETEN
  scsi: scsi_debug: Validate the access parameters of WRITE ATOMIC (16)
  scsi: scsi_debug: Map the region written by WRITE ATOMIC (16)
  scsi: scsi_debug: Refuse a short WRITE ATOMIC (16) before writing it
  scsi: scsi_debug: Advance the write pointer over the data written
  scsi: scsi_debug: Do not write a partial physical block to a zoned device
  scsi: scsi_debug: Enforce physical block alignment of zoned writes
  scsi: scsi_debug: Report the residual of a write
  scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets
  scsi: scsi_debug: Evaluate scsi_debug_lbp() only once
  scsi: scsi_debug: Take the zone metadata lock before the data lock
  scsi: scsi_debug: Refuse a negative physblk_exp
  scsi: scsi_debug: Make atomic writes and ZBC emulation mutually exclusive
  ...

We need the usb/thunderbolt fixes in here to work off of.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge Linux 7.3-rc2 to resolve libata and mpi3mr merge conflicts.

Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

Conflicts:
	drivers/ata/libata-scsi.c
	drivers/scsi/mpi3mr/mpi3mr_transport.c

Damien Le Moal <dlemoal@kernel.org> says:

This patch series defines as macros all ASC/ASCQ combinations present in
https://www.t10.org/lists/asc-num.txt and converts the SCSI core code and
SCSI low level drivers to use these macros instead of hard-coded
ASC/ASCQs. To do this, struct scsi_sense_hdr and struct scsi_failure are
modified to replace the asc and ascq 8-bits fields with a 16-bits
sense_code field.

This cleans up the code in many places and makes it easier, and self
documented, to test sense codes in the case of errors.

Overall, there should be no functional chnages here.

Note: this series currently applies cleanly only to the scsi-staging tree.
It does not apply to Linus tree as commit 6d81700ad7c4 ("ata: libata-scsi:
do not raise UA for storage element depopulation and restoration") creates
a conflict with patch 37. The conflict is trivial to resolve, but this
will create a conflict in linux-next. Could you maybe rebase scsi-staging
on rc2 ?

Also please note that sashiko did comment about several pre-existing
issues for different drivers, but I am not addressing these issues in
this series.

[mkp: fixed ufs conflict]

Link: https://patch.msgid.link/20260908090308.1085097-1-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

Refactor the USB mass storage driver to replace all hard-coded additional
sense codes and additional sense code qualifiers with the enum values
defined in include/scsi/scsi_sense.h. This helps with code clarity as the
sense codes being processed are easier to test and self-documented.

No functional change intended.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260908090308.1085097-36-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

Instead of passing the sense key, additional sense code and additional
sense code qualifier as separate parameters, change the functions
scsi_extd_sense_format(), scsi_format_extd_sense(), and
usb_stor_show_sense() to take a pointer to a struct scsi_sense_hdr to
access the sense key and sense code with a single argument.

No functional change intended.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260908090308.1085097-7-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
from the device via usb_control_msg(), but its callers only treat a
negative return value as failure. A device that answers the
vendor-specific GetSwocInfo request with a short IN transfer is
therefore accepted, leaving the tail of the freshly allocated
(kmalloc(), non-zeroing) swoc_info buffer uninitialized.

truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
and swocInfo->LinuxVer from that buffer into the world-readable
(0444) "truinst" sysfs attribute. An emulated/malicious USB device
(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
once per sysfs read, indefinitely. On kernels built without
init_on_alloc this leaks recently freed heap contents.

Only accept the transfer when the full structure was received.
sierra_ms_init() already retries failed queries, so well-behaved
devices are unaffected.

Fixes: 32fe5e393455 ("USB Storage Sierra: TRU-Install feature update")
Cc: stable <stable@kernel.org>
Signed-off-by: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
Assisted-by: Kimi:K2 [Kimi Code CLI]
Link: https://patch.msgid.link/20260910140343.49371-1-syedlabeeq@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ene_ub6250_probe() sets us->transport but never sets
us->transport_reset. get_transport() only fills in transport_reset
for the standard USB_PR_CB/CBI/BULK protocols; since this driver
matches on VID/PID alone, a device can report any bInterfaceProtocol
value and still bind, leaving transport_reset NULL.

When the transport then reports an error, usb_stor_invoke_transport()
calls us->transport_reset(us) in its Handle_Errors path, dereferencing
a NULL function pointer:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:0x0
  Call Trace:
   usb_stor_invoke_transport+0x55a/0x1a40 drivers/usb/storage/transport.c:926
   usb_stor_control_thread+0x44c/0x8f0 drivers/usb/storage/usb.c:462
   kthread+0x38b/0x480 kernel/kthread.c:436

Set transport_reset to usb_stor_Bulk_reset: ene_send_scsi_cmd()
already frames its command/status packets with the shared
struct bulk_cb_wrap/bulk_cs_wrap from include/linux/usb/storage.h
and only ever transfers over us->send_bulk_pipe/recv_bulk_pipe, i.e.
this device speaks the Bulk-Only Transport wire protocol underneath
its own SCSI translation layer, so the Bulk-Only reset is the correct
recovery action for it, matching the pattern already used by the
other subdrivers with a custom transport function (alauda, datafab,
jumpshot, karma).

Also harden usb_stor_probe2()'s existing sanity check to require
transport_reset alongside transport and proto_handler, so a future
subdriver making the same mistake fails to probe instead of crashing
on the first error recovery.

Reported-by: syzbot+356ae236154297f0d60d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=356ae236154297f0d60d
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260909171926.54111-1-ngocthang2710.1999@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

MEDIA_INFO(us).lba_to_pba and .pba_to_lba are arrays of num_zones
pointers, allocated by kcalloc() in alauda_init_media().
alauda_ensure_map_for_zone() reads lba_to_pba[zone] and
pba_to_lba[zone], and when either is NULL alauda_read_map() writes a
pointer back to both. Two separate errors let zone reach num_zones, one
element past the end.

max_lba is capacity >> (blockshift + pageshift), which counts physical
blocks, but zone is lba / uzonesize and uzonesize is 125/128 of
zonesize. On a 16 MB card (alauda_card_ids id 0x73) num_zones is 1 and
uzonesize is 1000, so lba 1000 to 1023 pass the bounds check and index
element 1 of a one-element array.

alauda_read_data() also calls alauda_ensure_map_for_zone() before it
compares lba against max_lba, so any larger lba is used as an index
before the check rejects it. alauda_write_data() already checks first.

Bound lba by num_zones * uzonesize on both paths and move the read
side's call below the check. alauda_transport() reports
num_zones * uzonesize * blocksize for READ_CAPACITY, so the new bound is
exactly the range the device advertises and no block becomes
unreachable.

sd never issues an lba past the reported capacity; an SG_IO READ_10 can.

Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Arka Mondal <arka@arkamondal.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260901065831.43567-4-arka@arkamondal.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>