rivers. Only affects the HID gadget function’s queuing
    behavior.
  - Low regression risk:
    - The host initiates IN transactions; setting `req->zero` only
      enables the device to respond with a ZLP if the host issues
      another IN token and a ZLP is needed. If not needed (e.g., host
      requested exactly the bytes provided), no extra transaction
      occurs.
    - For EP0 control transfers, UDCs commonly decide ZLP behavior based
      on both `req->zero` and the requested length; sending a ZLP when
      the last packet is full-sized is spec-compliant and commonly
      handled.
    - UDCs that don’t support ZLPs typically advertise quirks (see
      include/linux/usb/gadget.h:407) and ignore the flag safely.

- Stable backport criteria
  - Fixes a real, standards-compliance bug that can lead to incomplete
    termination and observable hangs with some UDCs/hosts when HID
    reports are maxpacket-aligned.
  - Extremely small and contained (two assignments), no behavior changes
    outside HID gadget transfers.
  - No features added; purely correctness per USB 2.0 spec.
  - Touches a non-critical subsystem (USB gadget HID function).

- Additional context
  - The GET_REPORT workqueue path still sets `req->zero = 0`
    intentionally (drivers/usb/gadget/function/f_hid.c:575). This patch
    does not alter that path, focusing only on the normal IN write and
    EP0 respond flows, which are the typical places where ZLP needs to
    be enabled by default.

Given the above, this is a safe, low-risk bug fix that improves
standards compliance and interoperability for HID gadget transfers and
should be backported.

 drivers/usb/gadget/function/f_hid.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 8e1d1e8840503..307ea563af95e 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -511,7 +511,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
 	}
 
 	req->status   = 0;
-	req->zero     = 0;
+	req->zero     = 1;
 	req->length   = count;
 	req->complete = f_hidg_req_complete;
 	req->context  = hidg;
@@ -967,7 +967,7 @@ static int hidg_setup(struct usb_function *f,
 	return -EOPNOTSUPP;
 
 respond:
-	req->zero = 0;
+	req->zero = 1;
 	req->length = length;
 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
 	if (status < 0)
-- 
2.51.0[PATCH AUTOSEL 6.17-5.4] usb: gadget: f_hid: Fix zero length packet transferSasha Levin <sashal@kernel.org> undefinedpatches@lists.linux.dev, stable@vger.kernel.org undefined undefined undefined undefined undefined undefined undefined undefined undefined undefined undefinedªKƒÇ6