Merge tag 'u-boot-dfu-20250410' of https://source.denx.de/u-boot/custodians/u-boot-dfu

u-boot-dfu-20250410

CI:
- https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/25615

Usb gadget:
- Add SAM9X60 support to atmel driver
- Fix memory leaks in f_mass_storage gadget driver
- Fix comment typo in dwc3 gadget driver

Fastboot:
- Lift restrictions on !NET_LWIP for USB

Android:
- Fix possible NULL ptr when AVB is out of memory
diff --git a/arch/arm/mach-at91/include/mach/atmel_usba_udc.h b/arch/arm/mach-at91/include/mach/atmel_usba_udc.h
index 835b47d..23c7198 100644
--- a/arch/arm/mach-at91/include/mach/atmel_usba_udc.h
+++ b/arch/arm/mach-at91/include/mach/atmel_usba_udc.h
@@ -20,7 +20,7 @@
 	}
 
 #if defined(CONFIG_AT91SAM9G45) || defined(CONFIG_AT91SAM9M10G45) || \
-	defined(CONFIG_AT91SAM9X5)
+	defined(CONFIG_AT91SAM9X5) || defined(CONFIG_SAM9X60)
 static struct usba_ep_data usba_udc_ep[] = {
 	EP("ep0", 0, 64, 1, 0, 0),
 	EP("ep1", 1, 1024, 2, 1, 1),
diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
index a5a86b2..654ebfd 100644
--- a/boot/bootmeth_android.c
+++ b/boot/bootmeth_android.c
@@ -455,7 +455,8 @@
 		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
 			printf("Verification failed, reason: %s\n",
 			       str_avb_slot_error(result));
-			avb_slot_verify_data_free(out_data);
+			if (out_data)
+				avb_slot_verify_data_free(out_data);
 			return log_msg_ret("avb verify", -EIO);
 		}
 		boot_state = AVB_GREEN;
@@ -465,7 +466,8 @@
 		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
 			printf("Unlocked verification failed, reason: %s\n",
 			       str_avb_slot_error(result));
-			avb_slot_verify_data_free(out_data);
+			if (out_data)
+				avb_slot_verify_data_free(out_data);
 			return log_msg_ret("avb verify unlocked", -EIO);
 		}
 		boot_state = AVB_ORANGE;
diff --git a/cmd/fastboot.c b/cmd/fastboot.c
index d4cfc0c..be84a48 100644
--- a/cmd/fastboot.c
+++ b/cmd/fastboot.c
@@ -16,6 +16,7 @@
 #include <linux/printk.h>
 #include <linux/stringify.h>
 
+#if CONFIG_IS_ENABLED(NET)
 static int do_fastboot_udp(int argc, char *const argv[],
 			   uintptr_t buf_addr, size_t buf_size)
 {
@@ -55,6 +56,7 @@
 
 	return CMD_RET_SUCCESS;
 }
+#endif
 
 static int do_fastboot_usb(int argc, char *const argv[],
 			   uintptr_t buf_addr, size_t buf_size)
@@ -160,10 +162,12 @@
 
 	fastboot_init((void *)buf_addr, buf_size);
 
+#if CONFIG_IS_ENABLED(NET)
 	if (!strcmp(argv[1], "udp"))
 		return do_fastboot_udp(argc, argv, buf_addr, buf_size);
 	if (!strcmp(argv[1], "tcp"))
 		return do_fastboot_tcp(argc, argv, buf_addr, buf_size);
+#endif
 	if (!strcmp(argv[1], "usb")) {
 		argv++;
 		argc--;
diff --git a/drivers/fastboot/Kconfig b/drivers/fastboot/Kconfig
index 1eb460f..7020757 100644
--- a/drivers/fastboot/Kconfig
+++ b/drivers/fastboot/Kconfig
@@ -1,6 +1,5 @@
 menu "Fastboot support"
 	depends on CMDLINE
-	depends on !NET_LWIP
 
 config FASTBOOT
 	bool
diff --git a/drivers/fastboot/fb_common.c b/drivers/fastboot/fb_common.c
index 12ffb46..68f92c4 100644
--- a/drivers/fastboot/fb_common.c
+++ b/drivers/fastboot/fb_common.c
@@ -183,11 +183,15 @@
 	switch (command) {
 	case FASTBOOT_COMMAND_BOOT:
 		fastboot_boot();
+#if CONFIG_IS_ENABLED(NET)
 		net_set_state(NETLOOP_SUCCESS);
+#endif
 		break;
 
 	case FASTBOOT_COMMAND_CONTINUE:
+#if CONFIG_IS_ENABLED(NET)
 		net_set_state(NETLOOP_SUCCESS);
+#endif
 		break;
 
 	case FASTBOOT_COMMAND_REBOOT:
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 477ecd0..2b01113 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1635,7 +1635,7 @@
 		/*
 		 * Special workaround for NXP UUU tool in SPL.
 		 *
-		 * The tool excepts the interrupt-in endpoint to be ep1in,
+		 * The tool expects the interrupt-in endpoint to be ep1in,
 		 * otherwise it crashes. This is a result of the previous
 		 * hard-coded EP setup in drivers/usb/gadget/epautoconf.c
 		 * which did special-case EP allocation for SPL builds,
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index a77037a..f9326f0 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -1443,6 +1443,7 @@
 	{ .compatible = "atmel,at91sam9rl-udc" },
 	{ .compatible = "atmel,at91sam9g45-udc" },
 	{ .compatible = "atmel,sama5d3-udc" },
+	{ .compatible = "microchip,sam9x60-udc" },
 	{}
 };
 
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index d3fc4ac..71dc58d 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -284,7 +284,6 @@
 #define kthread_create(...)	__builtin_return_address(0)
 #define wait_for_completion(...) do {} while (0)
 
-struct kref {int x; };
 struct completion {int x; };
 
 struct fsg_dev;
@@ -345,8 +344,6 @@
 	/* Vendor (8 chars), product (16 chars), release (4
 	 * hexadecimal digits) and NUL byte */
 	char inquiry_string[8 + 16 + 4 + 1];
-
-	struct kref		ref;
 };
 
 struct fsg_config {
@@ -2436,7 +2433,7 @@
 	return 0;
 }
 
-static void fsg_common_release(struct kref *ref);
+static void fsg_common_release(struct fsg_common *common);
 
 static struct fsg_common *fsg_common_init(struct fsg_common *common,
 					  struct usb_composite_dev *cdev)
@@ -2548,16 +2545,12 @@
 	common->nluns = i + 1;
 error_release:
 	common->state = FSG_STATE_TERMINATED;	/* The thread is dead */
-	/* Call fsg_common_release() directly, ref might be not
-	 * initialised */
-	fsg_common_release(&common->ref);
+	fsg_common_release(common);
 	return ERR_PTR(rc);
 }
 
-static void fsg_common_release(struct kref *ref)
+static void fsg_common_release(struct fsg_common *common)
 {
-	struct fsg_common *common = container_of(ref, struct fsg_common, ref);
-
 	/* If the thread isn't already dead, tell it to exit now */
 	if (common->state != FSG_STATE_TERMINATED) {
 		raise_exception(common, FSG_STATE_EXIT);
@@ -2571,8 +2564,6 @@
 		/* In error recovery common->nluns may be zero. */
 		for (; i; --i, ++lun)
 			fsg_lun_close(lun);
-
-		kfree(common->luns);
 	}
 
 	{
@@ -2648,6 +2639,7 @@
 		raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
 	}
 
+	fsg_common_release(fsg->common);
 	free(fsg->function.descriptors);
 	free(fsg->function.hs_descriptors);
 	kfree(fsg);
@@ -2751,6 +2743,8 @@
 	struct fsg_common *fsg_common;
 
 	fsg_common = fsg_common_init(NULL, c->cdev);
+	if (IS_ERR(fsg_common))
+		return PTR_ERR(fsg_common);
 
 	fsg_common->vendor_name = 0;
 	fsg_common->product_name = 0;