kernel/git/stable/linux.git/sound/usb, branch master

ALSA: caiaq: Fix potential double-free at error path

2026-09-03T16:08:24+00:00

The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch suggested, some of the audio resources such as URBs have been already freed, and this may lead to a double-free. For addressing the double-free, call the common destructor function from each place, and assure that the resource pointers get cleared. Link: https://sashiko.dev/#/patchset/20260903084747.535367-1-eadavis%40sina.com Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly") Link: https://patch.msgid.link/20260903103855.1807838-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: usb-audio: Add mixer map quirk for Audient iD24

2026-09-01T10:39:37+00:00

The Audient iD24 (2708:000d) exposes feature unit 12 as a 4-channel "Speaker Playback Volume" control (cmask 0xf, -127..0 dB). The device does not actually apply this volume to all of its output channels: the left main output ignores it and stays at 0 dB, while the right main output honors it. When userspace (PulseAudio / PipeWire in a stereo profile) adopts this control as the master playback volume, any setting below maximum produces a stereo imbalance on the main outputs. This was verified against the device's internal meters: with the control set to 107/127 (-20 dB) on all four channels and a digitally identical L/R sine played back, both DAW return meters read the same level while the right main output metered exactly 20 dB below the left. Restoring the control to 127 (0 dB) restored the balance. Rename the control to "Monitor Mix Playback" so that it is not picked up as the stream's master volume control, in line with similar quirks for other devices. The control remains accessible for manual use. Signed-off-by: Peter Drabik Link: https://patch.msgid.link/20260831195855.1836617-1-drabik.p@gmail.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()

2026-09-01T10:36:53+00:00

The snd_usbmidi_us122l_output() picks a count of 2 on anything slower than high speed and never relates it to ep->max_transfer. The URB buffer holds exactly max_transfer bytes, so a device declaring a one byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX. Only 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at 0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the USB core only clamps downward. The akai and novation output ops in this file were given the same guard recently. Do the same here. Fixes: 030a07e44129 ("ALSA: Add USB US122L driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An Link: https://patch.msgid.link/20260901090409.1478573-1-sammiee5311@gmail.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: Guard FCP protocol transfers

2026-08-31T07:54:18+00:00

FCP meter and hwdep operations issue control transfers without preventing runtime suspend or disconnect. Protect the central request-and-response transport. One reference then covers the command, acknowledgment wait, and response. The initial step-zero request bypasses that transport. Hold an outer reference across the complete initialization sequence so the device stays active through step zero, notification-URB setup, and both initialization commands. The central transport keeps its guard for calls outside initialization; the existing active counter balances the nested calls. FCP has no private resume callback. Its suspend callback only removes the notification URB. Taking the initialization and transport guards under the existing protocol mutex causes no resume-side lock inversion. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260827232143.149197-7-mrwillporter@gmail.com

ALSA: usb-audio: Add PM guards to RME Digiface controls

2026-08-31T07:54:18+00:00

The RME Digiface status and register helpers issue vendor requests without preventing runtime suspend or disconnect. The volatile status controls can repeatedly reach these unguarded paths while userspace polls them. Protect both helpers with snd_usb_lock. All Digiface get and put callbacks then resume the device and hold the disconnect reference across their transfer. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260827232143.149197-6-mrwillporter@gmail.com

ALSA: usb-audio: Guard Scarlett2 protocol transfers

2026-08-31T07:54:18+00:00

Scarlett2 controls and hwdep operations reach the proprietary USB transport without preventing runtime suspend or disconnect. Protect the central request-and-response helper. One reference then covers the command, acknowledgment wait, and response. The runtime and system resume hook submits only the notification URB. It takes no protocol mutex. Thus, the transport guard does not invert the existing data_mutex or usb_mutex order. Keep the suspend-time config save on the unguarded helper because it runs inside the USB suspend callback. This change protects each USB transaction. It does not hold a runtime-PM reference across the asynchronous flash-erase interval. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260827232143.149197-5-mrwillporter@gmail.com

ALSA: usb-audio: Add PM guard to Scarlett meter reads

2026-08-31T07:54:18+00:00

The Scarlett Gen 1 meter callback reads the device without preventing runtime suspend or disconnect. The transfer can fail when userspace polls the volatile control after the device suspends. Hold snd_usb_lock across the meter request. This matches the guarded Forte and common mixer control paths in this file. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260827232143.149197-4-mrwillporter@gmail.com

ALSA: usb-audio: Add PM guards to US-16x08 transfers

2026-08-31T07:54:18+00:00

The TASCAM control helpers submit vendor requests without preventing runtime suspend or disconnect. This affects mixer writes and the volatile meter path. Protect both send and receive helpers with snd_usb_lock. Acquire the PM guard before chip->mutex in the receive path so autoresume cannot invert the mutex order. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260827232143.149197-3-mrwillporter@gmail.com

ALSA: usb-audio: Add PM guard to Studio 1810c controls

2026-08-31T07:54:18+00:00

The Studio 1810c control callbacks issue vendor transfers without preventing runtime suspend or disconnect. A transfer attempted after runtime suspend can fail because the USB device cannot accept submissions. Take snd_usb_lock before the driver data and USB mutexes in both callbacks. This resumes the device before either the state read or control write. It also prevents disconnect cleanup from racing the complete operation. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260827232143.149197-2-mrwillporter@gmail.com

ALSA: usb-audio: Complete cleanup after system-resume errors

2026-08-25T08:01:44+00:00

A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf. The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup. usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles. Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry. Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations. No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request. Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover. I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection. Assisted-by: Claude:claude-opus-5 Assisted-by: Antigravity:gemini-3.1-pro-high Assisted-by: Codex:gpt-5.6-sol Fixes: 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") Fixes: 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") Cc: Signed-off-by: Will Porter Link: https://patch.msgid.link/20260824225757.26749-1-mrwillporter@gmail.com Signed-off-by: Takashi Iwai