summaryrefslogtreecommitdiff
path: root/sound
AgeCommit message (Collapse)Author
3 daystreewide: refresh kmalloc_obj() conversionsKees Cook
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>
5 daysALSA: caiaq: Fix potential double-free at error pathTakashi Iwai
The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch suggested, some of the audio resources such as URBs have been already freed, and this may lead to a double-free. For addressing the double-free, call the common destructor function from each place, and assure that the resource pointers get cleared. Link: https://sashiko.dev/#/patchset/20260903084747.535367-1-eadavis%40sina.com Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly") Link: https://patch.msgid.link/20260903103855.1807838-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
6 daysALSA: hda/realtek: Fix cold-boot headset misdetection on Acer Aspire A515-57GOleksandr Kovalov
On the Acer Aspire A515-57G (PCI SSID 1025:1616), if headphones are already inserted into the combo jack before the codec powers up (a cold boot with the plug already seated), the impedance-based headset-type sensing races and misclassifies the jack. This drives the wrong output configuration and is audible as missing center-panned content (e.g. vocals) while panned content plays normally. A genuine physical unplug/replug after boot reliably fixes this by forcing a fresh sense transient, which is a strong hint about the underlying cause: the sensing hardware appears to need a settled, freshly-triggered read rather than the one-shot classification done during the normal HDA_FIXUP_ACT_INIT pass. Add a machine-specific fixup that, on cold boot only (not S3/S4 resume, which already gets its own re-check), waits briefly after the normal init-time decision and then forces a fresh headset-mode classification by resetting the cached mode and re-invoking the existing alc_fixup_headset_mode() path -- mirroring what a manual replug already does. The wait+recheck is skipped whenever the first pass already determined nothing is plugged in, to avoid adding boot latency on the common case. Chain into the existing ALC256_FIXUP_ACER_SFG16_MICMUTE_LED fixup so this quirk-table entry keeps providing mic-mute LED support alongside the cold-boot headset fix. Tested on kernel 7.1.9 by building the affected module standalone and confirming cold boot with headphones pre-inserted plays correctly from the very first sample, across multiple boots (including a full restart, and headphones inserted mid-POST rather than before power-on), with no crashes or warnings and no behavioral difference from a real post-replug recovery. Signed-off-by: Oleksandr Kovalov <oleksandr.kovalov.work@gmail.com> Link: https://patch.msgid.link/20260902171305.3955-1-oleksandr.kovalov.work@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
6 daysALSA: rawmidi: Return the error from snd_rawmidi_input_params()HyeongJun An
The snd_rawmidi_input_params() computes err for the three invalid mode combinations and for resize_runtime_buffer(), applies the new framing and clock type only when err is zero, and then returns 0 anyway. A caller that asked for parameters the kernel rejected is told the change succeeded, and the substream keeps its old buffer. The open_mutex conversion turned the early returns into assignments. It handled the output sibling correctly, which still returns err, and left this one behind. Fixes: 94b98194b62e ("ALSA: rawmidi: Take open_mutex around parameter changes") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260902125058.19499-1-sammiee5311@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
6 daysALSA: ump: do not touch legacy_rmidi before it existsQingyu Zhang
snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf). Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists. Fixes: 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing") Signed-off-by: Qingyu Zhang <usupergate@gmail.com> Link: https://patch.msgid.link/20260902073918.880245-1-usupergate@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
6 daysALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2Jonne Vuorela
The MacBookAir 7,2 HDA controller has PCI subsystem 8086:7270 rather than Apple 0x106b, so no fixup is selected and all pins default to 0x400000f0. The pin wiring matches MBA6, so add the subsystem ID to both lookup tables pointing to CS4208_MBA6. Tested on MacBookAir 7,2. [ sorted table entries in SSID order -- tiwai ] Signed-off-by: Jonne Vuorela <jonne.vuorela@proton.me> Link: https://patch.msgid.link/Qcui5livawCaJbO1jfx_jebS64rR0f9KATkqn8May0pPyLw8U5DqPQBigmSzRxJp-GeMPqs-jAK6PCnagk3bspzmH__YPte-eyvPtFtuolo=@proton.me Signed-off-by: Takashi Iwai <tiwai@suse.de>
7 daysALSA: dummy: Report a change when one capture switch channel movesHyeongJun An
The snd_dummy_capsrc_put() builds its change flag with &&, so it reports a change only when both channels move at once. Writing a single channel stores the new value and returns 0, the control core then sends no SNDRV_CTL_EVENT_MASK_VALUE, and a second reader keeps showing the old setting until it polls again. The volume put a few lines above compares the same pair of channels with ||. The mixer selftest already reports this. With snd-dummy loaded it fails event_missing on all five capture switches: # CD Capture Switch.1 orig 0 read 1, is_volatile 0 not ok 13 event_missing.Dummy.9 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260901153921.3971-1-sammiee5311@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
7 daysALSA: usb-audio: Add mixer map quirk for Audient iD24Peter Drabik
The Audient iD24 (2708:000d) exposes feature unit 12 as a 4-channel "Speaker Playback Volume" control (cmask 0xf, -127..0 dB). The device does not actually apply this volume to all of its output channels: the left main output ignores it and stays at 0 dB, while the right main output honors it. When userspace (PulseAudio / PipeWire in a stereo profile) adopts this control as the master playback volume, any setting below maximum produces a stereo imbalance on the main outputs. This was verified against the device's internal meters: with the control set to 107/127 (-20 dB) on all four channels and a digitally identical L/R sine played back, both DAW return meters read the same level while the right main output metered exactly 20 dB below the left. Restoring the control to 127 (0 dB) restored the balance. Rename the control to "Monitor Mix Playback" so that it is not picked up as the stream's master volume control, in line with similar quirks for other devices. The control remains accessible for manual use. Signed-off-by: Peter Drabik <drabik.p@gmail.com> Link: https://patch.msgid.link/20260831195855.1836617-1-drabik.p@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
7 daysALSA: hda: restore MFG widget enumeration after core splitXu Rao
Before commit 7639a06c23c7 ("ALSA: hda - Move a part of hda_codec stuff into hdac_device"), widget enumeration selected the function group with codec->afg ? codec->afg : codec->mfg and read subordinate nodes from that group. The core split moved this logic into snd_hdac_refresh_widgets(), but hard-coded codec->afg there. For an MFG-only codec, codec->afg is zero, so the Root Node is queried and codec->start_nid/num_nodes are populated from the function-group range instead of the MFG's subordinate nodes. Restore the pre-split AFG-or-MFG selection. Fixes: 7639a06c23c7 ("ALSA: hda - Move a part of hda_codec stuff into hdac_device") Signed-off-by: Xu Rao <raoxu@uniontech.com> Link: https://patch.msgid.link/44809B8FF80DCCA2+20260901034024.2407783-1-raoxu@uniontech.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
7 daysALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()HyeongJun An
The snd_usbmidi_us122l_output() picks a count of 2 on anything slower than high speed and never relates it to ep->max_transfer. The URB buffer holds exactly max_transfer bytes, so a device declaring a one byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX. Only 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at 0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the USB core only clamps downward. The akai and novation output ops in this file were given the same guard recently. Do the same here. Fixes: 030a07e44129 ("ALSA: Add USB US122L driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260901090409.1478573-1-sammiee5311@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAFYilin Zhang
snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free. remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them. This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and the check/free sequence can no longer interleave. A reproducer that turns this race into a stale writable mapping of the freed DMA buffer pages is available on request. Reported-by: Kimi Security Team <bug-report@moonshot.ai> Fixes: 92ee3c60ec9f ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls") Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai> Link: https://patch.msgid.link/20260831045506.889070-1-yilinzhang@moonshot.ai Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: harmony: initialize locks before requesting IRQRunyu Xiao
snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both locks before requesting the IRQ so the handler always sees valid lock state. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Link: https://patch.msgid.link/20260830063411.2215691-1-runyu.xiao@seu.edu.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: hda/realtek: Add quirk for VAIO VJS131Riku Matsumura
The VAIO VJS131 with an ALC233 codec incorrectly selects the headset microphone when no headset is connected. Add a PCI SSID quirk for 1d19:0006 to apply ALC233_FIXUP_ASUS_MIC_NO_PRESENCE, which configures pin 0x19 as a headset microphone without its own jack detection. Signed-off-by: Riku Matsumura <rick197.3@icloud.com> Link: https://patch.msgid.link/20260830000008.22371-1-rick197.3@icloud.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: pcm: Fix race between non-atomic ops and trigger-startTakashi Iwai
We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops (hw_params, hw_free and prepare) and the atomic ops aren't perfect; there is a check of the conflicting PCM state at the beginning of hw_params & co, but the atomic PCM ops can be still issued during the non-atomic PCM operations. An example such scenario is that a thread A re-issues the PREPARE or HW_PARAMS for the already prepared stream, while another thread B triggers the PCM start in the middle of the prepare operation. Although this usually doesn't lead to much serious issues, it can give some inconsistency as reported by syzkaller (such as ODEBUG warning). There are various atomic PCM ops, and basically the only problem is the PCM start as it operates from the PREPARED state. Other trigger commands (stop, etc) are for the running or the other special state, hence they are filtered as pre-condition. This patch is for preventing the PCM trigger-start during the non- atomic operations in order to address the problems above. Fortunately, the hw_params, hw_free and prepare operations call snd_pcm_buffer_access_lock(), and this can be used for checking the concurrent operations at the PCM trigger -- which sets the runtime->buffer_accessing to a negative (if possible), so the PCM trigger just needs to check the runtime->buffer_accessing value; if it's negative, it means the concurrent non-atomic PCM ops is running. Reported-by: syzbot+225231fce6755d40d078@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a8f0de8.1d9ded08.62e62.00b5.GAE@google.com Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260828115542.3999-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: hda/realtek: Add quirk for Acer Predator PHN16-72Zhang Heng
The Acer Predator PHN16-72 (subsystem ID 1025:1731) uses a Realtek ALC245 codec. The PCI SSID and HDA codec SSID are both 0x10251731, as confirmed in the system's ALSA diagnostic report. Apply ALC2XX_FIXUP_HEADSET_MIC to enable the headset microphone. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221811 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260828101704.354406-2-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10Zhang Heng
The Lenovo Yoga Slim 9 14ILL10 (83CX) uses ALC287 with CS35L56 amplifiers. Without a matching SSID entry the bass speakers stay silent. Add PCI SSID 17aa:380b (codec SSID 17aa:3905) to apply ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221902 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260828101704.354406-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 ↵feng liu
wake-up Inside cx_codec_ops.set_power_state, implement a 1‑second delay after resuming from the S3 state before sending the power command to the codec AFG, thereby preventing potential transmission failures. Signed-off-by: feng liu <feng.liu@senarytech.com> Link: https://patch.msgid.link/20260828063456.1368-1-feng.liu@senaryTech.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysALSA: usb-audio: Guard FCP protocol transfersWill Porter
FCP meter and hwdep operations issue control transfers without preventing runtime suspend or disconnect. Protect the central request-and-response transport. One reference then covers the command, acknowledgment wait, and response. The initial step-zero request bypasses that transport. Hold an outer reference across the complete initialization sequence so the device stays active through step zero, notification-URB setup, and both initialization commands. The central transport keeps its guard for calls outside initialization; the existing active counter balances the nested calls. FCP has no private resume callback. Its suspend callback only removes the notification URB. Taking the initialization and transport guards under the existing protocol mutex causes no resume-side lock inversion. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter <mrwillporter@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827232143.149197-7-mrwillporter@gmail.com
8 daysALSA: usb-audio: Add PM guards to RME Digiface controlsWill Porter
The RME Digiface status and register helpers issue vendor requests without preventing runtime suspend or disconnect. The volatile status controls can repeatedly reach these unguarded paths while userspace polls them. Protect both helpers with snd_usb_lock. All Digiface get and put callbacks then resume the device and hold the disconnect reference across their transfer. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter <mrwillporter@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827232143.149197-6-mrwillporter@gmail.com
8 daysALSA: usb-audio: Guard Scarlett2 protocol transfersWill Porter
Scarlett2 controls and hwdep operations reach the proprietary USB transport without preventing runtime suspend or disconnect. Protect the central request-and-response helper. One reference then covers the command, acknowledgment wait, and response. The runtime and system resume hook submits only the notification URB. It takes no protocol mutex. Thus, the transport guard does not invert the existing data_mutex or usb_mutex order. Keep the suspend-time config save on the unguarded helper because it runs inside the USB suspend callback. This change protects each USB transaction. It does not hold a runtime-PM reference across the asynchronous flash-erase interval. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter <mrwillporter@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827232143.149197-5-mrwillporter@gmail.com
8 daysALSA: usb-audio: Add PM guard to Scarlett meter readsWill Porter
The Scarlett Gen 1 meter callback reads the device without preventing runtime suspend or disconnect. The transfer can fail when userspace polls the volatile control after the device suspends. Hold snd_usb_lock across the meter request. This matches the guarded Forte and common mixer control paths in this file. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter <mrwillporter@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827232143.149197-4-mrwillporter@gmail.com
8 daysALSA: usb-audio: Add PM guards to US-16x08 transfersWill Porter
The TASCAM control helpers submit vendor requests without preventing runtime suspend or disconnect. This affects mixer writes and the volatile meter path. Protect both send and receive helpers with snd_usb_lock. Acquire the PM guard before chip->mutex in the receive path so autoresume cannot invert the mutex order. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter <mrwillporter@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827232143.149197-3-mrwillporter@gmail.com
8 daysALSA: usb-audio: Add PM guard to Studio 1810c controlsWill Porter
The Studio 1810c control callbacks issue vendor transfers without preventing runtime suspend or disconnect. A transfer attempted after runtime suspend can fail because the USB device cannot accept submissions. Take snd_usb_lock before the driver data and USB mutexes in both callbacks. This resumes the device before either the state read or control write. It also prevents disconnect cleanup from racing the complete operation. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Will Porter <mrwillporter@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827232143.149197-2-mrwillporter@gmail.com
11 daysMerge tag 'sound-fix-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of various small fixes since the last PR. Most changes are device-specific fixes, while there are a few fixes addressing the issues reported recently by fuzzers. Here are highlights: ALSA Core: - Prevent adding invalid kcontrols to the LED layer - Workaround for a false-positive mutex lockdep warning in rawmidi USB-audio: - Relaxed the sticky mixer behavior check that caused regressions - Fix an OOB write in Novation MIDI output - Proper cleanup after system-resume errors - Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3 HD-audio: - Conexant headset plugin fixes - Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3, TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9 ASoC: - DAPM: Fix off-by-one check on the second enum channel - Tegra: Fix and sort register defaults - AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16, HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC - Fixes Qualcomm TDM handling - Fix double put_device() on SoundWire - Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926 Misc: - Fix card leak on probe error on ice1712 driver - Hardening for legacy aoa, mtpav and pcxhr drivers" * tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits) ALSA: control: Don't add invalid kcontrols to LED layer ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants ALSA: hda/conexant: Always enable the headset-mic pin on plugin ASoC: dapm: Fix off-by-one check on the second enum channel ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16 ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk ASoC: soc-generic-dmaengine: Fix DMA channel request warning ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt ALSA: usb-audio: Complete cleanup after system-resume errors ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8 ALSA: aoa: i2sbus: Check IRQ before requesting it ALSA: usb-audio: Skip mixer creation on M-Audio Venom ALSA: usb-audio: Skip reading sample rate on M-Audio Venom ASoC: rt766: add RT766/RT767 VA1 device IDs ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() ...
12 daysMerge tag 'mfd-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - MediaTek MT6397: Add mt6323 AUXADC support - MediaTek MT6397: Add mt6323 EFUSE support - Spreadtrum SC27xx: Add SC2730 regulator cell Improvements & Fixes: - Apple SMC: Fix key count endianness annotation - Azoteq IQS62x: Reject zero-length firmware records - ChromeOS EC: Introduce cros_ec_read_features helper and read features during probe to catch transfer errors - Cirrus Logic CS42L43: Fix regmap defaults ordering - Cirrus Logic CS42L43: Remove redundant NULL checks on SoundWire - Congatec Board Controller: Fix teardown ordering in cgbc_remove() - HP iPAQ Micro: Fix out-of-bounds stack read in ipaq_micro_str - Marvell 88PM886: Initialize the battery page - QNAP MCU: Keep the reply buffer alive past a command timeout - RAVE SP: Validate received frame payload lengths - Silicon Labs Si476x: Drop duplicate NULL checks - Silicon Labs Si476x: Modernize GPIO handling - Silicon Motion SM501: Fix potential memory leaks during remove - UCB1x00: Convert Assabet gpio-keys to use software nodes and register software node for GPIO controller - Viperboard: Fix native fields type in structures as little-endian - Viperboard: Remove redundant NULL check before kfree() - X-Powers AXP20x: Preserve other control bits when powering off Cleanups & Refactoring: - Core: Drop unused assignment of spi_device_id driver data - Core: Initialize spi_device_id arrays using member names - Core: Unify style of spi_device_id arrays - Maintainers: Add Intel LPSS section to follow the changes - Maintainers: Add a mailing list entry to MFD - Cirrus Logic CS42L43: Format sdw_device_id table - Cirrus Logic CS42L43: Use new SoundWire enumeration helper - ROHM PMIC: Factor out power button registration and convert gpio-keys to use software nodes - ST-Ericsson DB8500: Fold dbx500 header into db8500 Device Tree Binding Updates: - Core: Add techvision vendor prefix - Marvell 88PM886: Allow vbus regulator - MediaTek MT8195 SCP: Add support for MT8189 SoC - Qualcomm SPMI PMIC: Document PMG1110 - Qualcomm SPMI PMIC: Document haptics device - Qualcomm TCSR: Add compatible for Hawi and Maili SoCs - Qualcomm TCSR: Add compatible for Shikra - Qualcomm TCSR: Document the IPQ9650 TCSR block - STMicroelectronics STMPE: Fix typo st,stmpe601 (should be st,stmpe610) - Syscon: Add ESWIN EIC7700 compatible - Syscon: Allow syscon compatible for Loongson-2K0300 chip id - Syscon: Disallow simple-bus with syscon - Syscon: Drop custom select for older dtschema - TI OMAP USBHS TLL: Convert to DT schema" * tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits) mfd: cs42l43: Fix regmap defaults ordering dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip id dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatible mfd: qnap-mcu: keep the reply buffer alive past a command timeout dt-bindings: mfd: qcom,tcsr: Document the IPQ9650 TCSR block mfd: macsmc: Fix key count endianness annotation dt-bindings: mfd: qcom,spmi-pmic: Document haptics device mfd: iqs62x: Reject zero-length firmware records mfd: rave-sp: validate received frame payload lengths mfd: sm501: Fix potential memory leaks during remove mfd: viperboard: Fix native fields type in structures as little-endian mfd: si476x-i2c: Get rid of duplicate NULL checks dt-bindings: mfd: Convert OMAP USB TLL to DT schema mfd: cgbc: Fix teardown ordering in cgbc_remove() mfd: mt6397-core: Add mt6323 AUXADC support dt-bindings: mfd: qcom,tcsr: Add compatible for Hawi and Maili SoCs mfd: rohm: Factor out power button registration mfd: ucb1x00: Convert Assabet gpio-keys to use software nodes mfd: ucb1x00: Register software node for GPIO controller mfd: cs42l43: Tidy up formatting on sdw_device_id table ...
12 daysMerge tag 'asoc-fix-v7.3-merge-window' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.3 A fairly big batch of fixes that came in during the merge window. There's a lot of quirks for x86 systems and a bunch of driver specific fixes, the most critical being the fixes for Tegra's register definitions. It turned out that they had been relying on the regmap default handling bugs that were fixed in v7.2 and so audio was fairly badly broken, unfortunately the issue wasn't noticed in time for release.
12 daysALSA: control: Don't add invalid kcontrols to LED layerTakashi Iwai
The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller. For avoiding the Oops, add a sanity check of the kcontrol's info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer. Reported-by: syzbot+b7fe2760ea6f1ee44b4d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com Fixes: 22d8de62f11b ("ALSA: control - add generic LED trigger module as the new control layer") Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827113951.893291-1-tiwai@suse.de
12 daysASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variantsShengyu Qu
Existing quirk doesn't cover all known existing FA401EA devices, so use "FA401EA" to cover all of them. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221310#c49 Fixes: 27d090f3ccd4 ("ASoC: amd: acp: add ACP70 DMI override for new ASUS TUF platforms") Signed-off-by: Shengyu Qu <wiagn@4d2.org> Link: https://patch.msgid.link/20260826172050.15686-1-wiagn@4d2.org Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysALSA: hda/conexant: Always enable the headset-mic pin on pluginBob Song
Rename the function to cx_process_headset_detect_plug_type() to reflect that it only reports the detected plug type, and move the pin control write into cx_update_headset_mic_vref() so that node 0x19 is always set to enable the headset mic with the 80% VREF whenever the mic is present, regardless of the type detection result. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260826115344.2128835-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
13 daysASoC: dapm: Fix off-by-one check on the second enum channelHyeongJun An
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal to it. Both go on to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used >= there, and the snd_soc_put_enum_double() in soc-ops.c still does. Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off. Fixes: 3727b4968453 ("ASoC: dapm: Consolidate MUXs and value MUXs") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260825125745.932832-1-sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16Sehat Mahde
The BIOS on the HP OmniBook X Flip 16-cc0xxx (board 8EA2) reports acp-audio-config-flag = FLAG_AMD_LEGACY_ONLY_DMIC. This binds the legacy ACP driver and registers a PDM-only card, so the SoundWire links are never scanned and the two TAS2783 speaker amplifiers and RT712-VB codec do not enumerate. Add a DMI entry for board 8EA2 to the ACP70 ACPI flag override table so the firmware-provided flag is overridden and snd_pci_ps probes instead. On the affected system, an otherwise identical upstream kernel without this entry binds snd_acp_pci, enumerates no SoundWire slave devices and exposes no internal speaker PCM. With the entry added, snd_pci_ps binds, both TAS2783 amplifiers and the RT712-VB enumerate over SoundWire, and the amd-soundwire card exposes the internal speaker playback PCM. Developed with AI assistance. ChatGPT helped analyze the ACP and SoundWire behavior, structure the controlled A/B testing, and draft the patch changelog. All hardware measurements, kernel builds, reboots and playback tests were performed by the submitter. The submitter has reviewed the change, understands it and takes responsibility for it. Assisted-by: ChatGPT:GPT-5.6 Sol Signed-off-by: Sehat Mahde <hskmahde@gmail.com> Link: https://patch.msgid.link/20260825224640.13662-1-hskmahde@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirkMehmet Aysel
Add matching DMI table entry for the ES83xx machine driver, so the HUAWEI HVY-WXX9 / M1060 board (MateBook D16 2021, Ryzen 5 4600H) can successfully probe its ES8316 codec via the acp3x-es83xx machine driver, consistent with the existing M1010/M1020/M1040 entries for the same board name. Signed-off-by: Mehmet Aysel <mehmet4ysel@gmail.com> Link: https://patch.msgid.link/20260825092432.56292-2-mehmet4ysel@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirkMehmet Aysel
Add DMI match table entry for HUAWEI HVY-WXX9 board, product version M1060, a MateBook D16 2021 (Ryzen 5 4600H) revision not covered by the existing M1010/M1020/M1040 entries. This board uses the same FLAG_AMD_LEGACY / ACP_PCI_DEV_ID configuration as the other HVY-WXX9 variants. Signed-off-by: Mehmet Aysel <mehmet4ysel@gmail.com> Link: https://patch.msgid.link/20260825092432.56292-1-mehmet4ysel@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-generic-dmaengine: Fix DMA channel request warningbui duc phuc
The DMA channel request code currently warns about legacy DMA failures when the channel name is not present in dma-names. This can report a firmware lookup failure as a legacy DMA failure. Furthermore, failures from the legacy DMA path are already reported by find_candidate(), making these warnings redundant. Only warn when the channel name is present in dma-names but the request fails, avoiding misleading and duplicate error messages. Fixes: 9167f260477b ("ASoC: soc-generic-dmaengine: Handle DMA channel request failures correctly") Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://lore.kernel.org/all/aoyBuho270dTWYBL@jupiter.universe/ Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260825081949.55537-1-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
14 daysMerge tag 'char-misc-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ...
14 daysALSA: rawmidi: Another workaround for false-positive mutex lockdep warningTakashi Iwai
While we attempted to work around the false-positive lockdep warning due to the nested mutex lock in rawmidi at the open path for a UMP legacy rawmidi, it didn't cover the similar locking at its close path, and this still caused another false-positive reports by syzkaller. Add a similar workaround to snd_rawmidi_kernel_release() as done in the former commit 9c04742e73b3 ("ALSA: rawmidi: Work around false-positive mutex lockdep warning") to cover completely. Reported-by: syzbot+7d1edf0ff6a05961020c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a8c7e4d.4d75e56a.c9a88.0052.GAE@google.com Link: https://patch.msgid.link/20260825134942.1289272-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
14 daysASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMDZhang Heng
Add DMI entry so the YC machine driver probes on this model and the internal DMIC works. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221485 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260824130302.553419-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
14 daysASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UCChristopher Tolang
This model requires an additional detection quirk to enable the internal microphone. Fixes: fa991481b8b2 ("ASoC: amd: add YC machine driver using dmic") Cc: stable@vger.kernel.org Assisted-by: OpenAI Codex Signed-off-by: Christopher Tolang <christophertolang@gmail.com> Link: https://patch.msgid.link/20260823113221.19744-1-christophertolang@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
14 daysALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039ntHabil Eren Türker
HP Laptop 15-fd0039nt (SSID 103c:8bb6) needs a quirk to control the speaker mute LED via VREF100 on NID 0x1a (active-high). This patch replaces the previous ALC236_FIXUP_HP_MICMUTE_LED_ONLY with ALC236_FIXUP_HP_15_FD0XXX, which covers both mic mute (GPIO0) and speaker mute (NID 0x1a) LEDs. Use spec->no_shutup_pins instead of a custom shutup hook, as suggested by Takashi Iwai. Fixes: e711ebfadc9a ("ALSA: hda/realtek: Add quirk for HP Laptop 15-fd0039nt") Tested-by: Habil Eren Türker <habilerenturker@hotmail.com> Signed-off-by: Habil Eren Türker <habilerenturker@hotmail.com> Link: https://patch.msgid.link/20260825084125.4103-1-habilerenturker@hotmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-25ALSA: usb-audio: Complete cleanup after system-resume errorsWill Porter
A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf. The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup. usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles. Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry. Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations. No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request. Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover. I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection. Assisted-by: Claude:claude-opus-5 Assisted-by: Antigravity:gemini-3.1-pro-high Assisted-by: Codex:gpt-5.6-sol Fixes: 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") Fixes: 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") Cc: <stable@vger.kernel.org> Signed-off-by: Will Porter <mrwillporter@gmail.com> Link: https://patch.msgid.link/20260824225757.26749-1-mrwillporter@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-25ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8Zhang Heng
The internal microphone on Lenovo IdeaPad Slim 3 15ABR8 (subsystem 17aa:3862) exhibits severe distortion at default gain levels. The Capture Volume is fixed at 63 (max) and cannot be lowered without explicit userspace intervention. The existing fixup ALC269_FIXUP_LIMIT_INT_MIC_BOOST limits the gain range and resolves the issue. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221891 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260824123752.525173-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-25ALSA: aoa: i2sbus: Check IRQ before requesting itbui duc phuc
irq_of_parse_and_map() returns 0 when parsing or mapping an IRQ fails. The return value was passed to request_irq() without checking for failure. Check the return value before passing it to request_irq(). Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260824100730.31601-1-phucduc.bui@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-25ALSA: usb-audio: Skip mixer creation on M-Audio VenomFederico Valentín Andrade
The M-Audio Venom (0763:2084) does not answer any GET_CUR request of its feature units, hanging up the USB microcontroller and "responding" with timeouts. So the mixer building lasts around 47 seconds, and the device does not stream at all. The same GET_CUR requests issued through libusb (with no kernel driver bound) complete correctly and blazingly fast. So it seems to only happen during the initial probe. I defined an explicit composite quirk to bypass the mixer creation, as it is not needed (the synth already comes with volume controls). With both this and the device flag applied, the synth works flawlessly. Signed-off-by: Federico Valentín Andrade <fandrade@frba.utn.edu.ar> Link: https://patch.msgid.link/20260824140211.17003-3-fandrade@frba.utn.edu.ar Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-25ALSA: usb-audio: Skip reading sample rate on M-Audio VenomFederico Valentín Andrade
The M-Audio Venom (0763:2084) is an USB Audio Class 1 compliant synth with an integrated audio interface, it does not implement GET_CUR on SAMPLING_FREQ_CONTROL, hanging up if requested on endpoint 0. The first class request issued by the driver after enumeration is a GET_CUR on endpoint 0x02, freezing the device's USB microcontroller. Timing out on every transfer afterwards with -ETIMEDOUT, such as SET_INTERFACE, so neither the mixer nor any streaming interface is set up. Analyzing a USBPcap capture of the Windows driver I found it never requests the sampling frequency, as the synth exposes a single discrete of 44100Hz on both streaming interfaces, thus asking for it is unnecessary. So I applied get_sample_rate to avoid this check, and disable_autosuspend because the synth doesn't come back from being suspended. Signed-off-by: Federico Valentín Andrade <fandrade@frba.utn.edu.ar> Link: https://patch.msgid.link/20260824140211.17003-2-fandrade@frba.utn.edu.ar Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-24ASoC: rt766: add RT766/RT767 VA1 device IDsShuming Fan
This patch adds the RT766/RT767 VA1 device IDs, which support SoundWire v1.3. Signed-off-by: Shuming Fan <shumingf@realtek.com> Link: https://patch.msgid.link/20260824103936.3524080-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-24ALSA: hda/realtek: Add quirk for TongFang XxAF5xxxEckhart Mohr
Fix microphone detection on built in headphone jack for some devices Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com> Cc: stable@vger.kernel.org Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20260821144437.27233-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-24ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()Marouane El Moufid
snd_usbmidi_novation_output() lays out a two-byte header at transfer_buffer[0..1] and passes &transfer_buffer[2] together with a length of ep->max_transfer - 2 to snd_rawmidi_transmit(): count = snd_rawmidi_transmit(ep->ports[0].substream, &transfer_buffer[2], ep->max_transfer - 2); ep->max_transfer comes from the output endpoint's wMaxPacketSize via usb_maxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1. snd_rawmidi_transmit() passes the negative count on to __snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count" leaves count1 negative; get_aligned_size() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (size_t)-1 length and writes far past the transfer buffer, which was allocated with usb_alloc_coherent(ep->max_transfer). This is the same class of bug that was fixed for snd_usbmidi_akai_output() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Marouane El Moufid <eun0us@espilon.net> Link: https://patch.msgid.link/178749334830.543645.13722252148340572274@espilon.net Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-23ALSA: usb-audio: Add iD14 MkI to monitor-mix volume quirkWill Porter
Add the iD14 MkI USB ID to the existing audient_id14_map. This names feature unit 12 Monitor Mix Playback Volume. Live meter A/B testing on MkI USB ID 2708:0002 reproduced the same asymmetric attenuation seen on MkII. At ALSA value 104, the right channel was 23.07 dB below the left. At 127, both channels were equal. The misleading Speaker Playback Volume name causes PipeWire to adopt FU12 as the stream master. Reuse the existing map to keep the control available while preventing that selection. Hardware-tested on Bazzite 7.2.0-ogc4.1.fc44.x86_64 with this change backported. ALSA exposed Monitor Mix Playback Volume after module load and USB reconnect. PipeWire volume changes from 100% to 35% and back left all four FU12 values at 127. Channel-isolated left/right playback remained balanced after reconnect. Build-tested with CONFIG_SND_USB_AUDIO=m using the focused sound/usb target. Assisted-by: Codex:gpt-5 Signed-off-by: Will Porter <mrwillporter@gmail.com> Link: https://patch.msgid.link/20260823015353.686080-1-mrwillporter@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-23ALSA: usb-audio: Add quirk flags for Logitech PRO X WirelessRong Zhang
The Logitech PRO X Wireless is a wireless headset with a hotpluggable microphone. Its Playback mixer's GET_CUR somehow becomes broken when the microphone is detached, so set QUIRK_FLAG_MIXER_GET_CUR_OK to prevent the mixer behavior from depending on whether the microphone is attached. Meanwhile, the Playback mixer's minimum value doesn't work properly, thus set QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE to prevent userspace audio stack from using the minimum mixer value to tune volume (setting it when muted is OK). Reported-by: Alexander Niemeyer <adventureFAN@gmx.de> Closes: https://msgid.link/6262cbbd-d1f2-4c9d-a1c7-9c5d12636f4b@gmx.de Closes: https://msgid.link/7984832b-86f6-4934-bfc0-1ed70218973a@gmx.de Signed-off-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260823-uac-demote-sticky-check-v1-4-a8cbe572edff@rong.moe
2026-08-23ALSA: usb-audio: Reverse MIXER_GET_CUR_BROKEN as MIXER_GET_CUR_OKRong Zhang
The default behavior of sticky check now becomes what QUIRK_FLAG_MIXER_GET_CUR_BROKEN originally does, so the quirk flag is no longer needed. On some devices, whether their GET_CUR being sticky depends on whether hotpluggable components are present. When the hotpluggable components are missing on probe, their GET_CUR behavior is classified as broken. Therefore, reverse QUIRK_FLAG_MIXER_GET_CUR_BROKEN as QUIRK_FLAG_MIXER_GET_CUR_OK, so that it can be set to prevent the heuristics from gating GET_CUR. Note that even if the quirk flag is set, init_cur_mix_raw() should still initialize the mixer value to cval->min, otherwise restoring the bogus saved value on the first channel could lead to unbalanced channels. Signed-off-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260823-uac-demote-sticky-check-v1-3-a8cbe572edff@rong.moe