--- /dev/null
+From 8df560fefe6fed6a20b7e06720eeaeccec349ac0 Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 27 May 2026 20:09:14 +0800
+Subject: ALSA: aoa: check snd_ctl_new1() return value
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit 8df560fefe6fed6a20b7e06720eeaeccec349ac0 upstream.
+
+snd_ctl_new1() can return NULL when memory allocation fails. In
+layout.c, the function does not check the return value before
+dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can
+lead to a NULL pointer dereference.
+
+Add NULL checks after snd_ctl_new1() calls and return early if any
+fails.
+
+Assisted-by: Opencode:DeepSeek-V4-Flash
+Cc: stable@vger.kernel.org
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Link: https://patch.msgid.link/tencent_35F3A25FEEBF190A2E15ED787754C57E3708@qq.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/aoa/fabrics/layout.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/aoa/fabrics/layout.c
++++ b/sound/aoa/fabrics/layout.c
+@@ -948,6 +948,8 @@ static void layout_attached_codec(struct
+ if (lineout == 1)
+ ldev->gpio.methods->set_lineout(codec->gpio, 1);
+ ctl = snd_ctl_new1(&lineout_ctl, codec->gpio);
++ if (!ctl)
++ return;
+ if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
+ strscpy(ctl->id.name, "Headphone Switch");
+ ldev->lineout_ctrl = ctl;
+@@ -961,12 +963,16 @@ static void layout_attached_codec(struct
+ if (ldev->have_lineout_detect) {
+ ctl = snd_ctl_new1(&lineout_detect_choice,
+ ldev);
++ if (!ctl)
++ return;
+ if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
+ strscpy(ctl->id.name,
+ "Headphone Detect Autoswitch");
+ aoa_snd_ctl_add(ctl);
+ ctl = snd_ctl_new1(&lineout_detected,
+ ldev);
++ if (!ctl)
++ return;
+ if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
+ strscpy(ctl->id.name,
+ "Headphone Detected");
--- /dev/null
+From f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 18 Jun 2026 14:03:15 +0800
+Subject: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd upstream.
+
+snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
+stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
+iteration it advances buf and subtracts the block size while looping on
+"while (len)".
+
+len is urb->actual_length. That value is supplied by the device and is
+not guaranteed to be a multiple of 16. When a final short block leaves
+len between 1 and 15, the loop runs once more, reads up to buf[15], and
+then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
+to a huge value. The loop then keeps iterating and walking buf far past
+the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
+block id happens to be hit.
+
+Iterate only while a full message block is available. This stops the
+unsigned underflow and silently drops any trailing partial block, which
+carries no complete control value anyway.
+
+The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
+and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
+urb->actual_length before dispatching.
+
+Fixes: 15c5ab607045 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Link: https://patch.msgid.link/178176259547.3343534.2724779296835237429@maoyixie.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/caiaq/input.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch(
+ {
+ struct device *dev = caiaqdev_to_dev(cdev);
+
+- while (len) {
++ while (len >= TKS4_MSGBLOCK_SIZE) {
+ unsigned int i, block_id = (buf[0] << 8) | buf[1];
+
+ switch (block_id) {
--- /dev/null
+From c205bd1b28fb7e5f1061a4e78813fad7d315cb3e Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 27 May 2026 20:09:13 +0800
+Subject: ALSA: cmipci: check snd_ctl_new1() return value
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit c205bd1b28fb7e5f1061a4e78813fad7d315cb3e upstream.
+
+snd_ctl_new1() can return NULL when memory allocation fails.
+snd_cmipci_spdif_controls() does not check the return value before
+dereferencing kctl->id.device, which can lead to a NULL pointer
+dereference.
+
+Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
+fails.
+
+Assisted-by: Opencode:DeepSeek-V4-Flash
+Cc: stable@vger.kernel.org
+Fixes: f2f312ad88c6 ("ALSA: cmipci: Fix kctl->id initialization")
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Link: https://patch.msgid.link/tencent_964433DCD132125D5EDA79EE068A2D6EFA09@qq.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/cmipci.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/cmipci.c
++++ b/sound/pci/cmipci.c
+@@ -2637,16 +2637,22 @@ static int snd_cmipci_mixer_new(struct c
+ }
+ if (cm->can_ac3_hw) {
+ kctl = snd_ctl_new1(&snd_cmipci_spdif_default, cm);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = pcm_spdif_device;
+ err = snd_ctl_add(card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_cmipci_spdif_mask, cm);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = pcm_spdif_device;
+ err = snd_ctl_add(card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_cmipci_spdif_stream, cm);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = pcm_spdif_device;
+ err = snd_ctl_add(card, kctl);
+ if (err < 0)
--- /dev/null
+From 4a60127debb9e370d6c0e22a307326b624a141f3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Mon, 15 Jun 2026 10:37:26 -0300
+Subject: ALSA: compress: Fix task creation error unwind
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 4a60127debb9e370d6c0e22a307326b624a141f3 upstream.
+
+snd_compr_task_new() allocates the driver task before validating the
+returned DMA buffers and reserving file descriptors. When either of
+those later steps fails, the core frees its task wrapper and DMA-buffer
+references without calling the driver's task_free() callback. Any
+driver resources allocated by task_create() are therefore leaked.
+
+The dual-fd allocation path also jumps to cleanup without storing the
+negative get_unused_fd_flags() result in retval. Since retval still
+contains the successful task_create() return value, TASK_CREATE can
+incorrectly report success although the task was discarded.
+
+Preserve the fd allocation errors and call task_free() when failure
+occurs after a successful task_create() callback.
+
+Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
+Fixes: 3d3f43fab4cf ("ALSA: compress_offload: improve file descriptors installation for dma-buf")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260615-alsa-compress-task-unwind-v1-1-39e8ad3ddb27@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/compress_offload.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -1070,15 +1070,18 @@ static int snd_compr_task_new(struct snd
+ file descriptors are allocated before fd_install() */
+ if (!task->input || !task->input->file || !task->output || !task->output->file) {
+ retval = -EINVAL;
+- goto cleanup;
++ goto free_driver_task;
+ }
+ fd_i = get_unused_fd_flags(O_WRONLY|O_CLOEXEC);
+- if (fd_i < 0)
+- goto cleanup;
++ if (fd_i < 0) {
++ retval = fd_i;
++ goto free_driver_task;
++ }
+ fd_o = get_unused_fd_flags(O_RDONLY|O_CLOEXEC);
+ if (fd_o < 0) {
++ retval = fd_o;
+ put_unused_fd(fd_i);
+- goto cleanup;
++ goto free_driver_task;
+ }
+ /* keep dmabuf reference until freed with task free ioctl */
+ get_dma_buf(task->input);
+@@ -1090,6 +1093,8 @@ static int snd_compr_task_new(struct snd
+ list_add_tail(&task->list, &stream->runtime->tasks);
+ stream->runtime->total_tasks++;
+ return 0;
++free_driver_task:
++ stream->ops->task_free(stream, task);
+ cleanup:
+ snd_compr_task_free(task);
+ return retval;
--- /dev/null
+From 1edd1f02dddd20aeb6066ded41017615766ea42f Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 27 May 2026 20:09:09 +0800
+Subject: ALSA: es1938: check snd_ctl_new1() return value
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit 1edd1f02dddd20aeb6066ded41017615766ea42f upstream.
+
+snd_ctl_new1() can return NULL when memory allocation fails.
+snd_es1938_mixer() does not check the return value before dereferencing
+the pointer, which can lead to a NULL pointer dereference.
+
+Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
+
+Assisted-by: Opencode:DeepSeek-V4-Flash
+Cc: stable@vger.kernel.org
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Link: https://patch.msgid.link/tencent_E0DC65165FDF2C8982BAFB6794B854B53B0A@qq.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/es1938.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/es1938.c
++++ b/sound/pci/es1938.c
+@@ -1655,6 +1655,8 @@ static int snd_es1938_mixer(struct es193
+ for (idx = 0; idx < ARRAY_SIZE(snd_es1938_controls); idx++) {
+ struct snd_kcontrol *kctl;
+ kctl = snd_ctl_new1(&snd_es1938_controls[idx], chip);
++ if (!kctl)
++ return -ENOMEM;
+ switch (idx) {
+ case 0:
+ chip->master_volume = kctl;
--- /dev/null
+From e0ecb324246be9cf3a0689346a658e48a38546b2 Mon Sep 17 00:00:00 2001
+From: "Geoffrey D. Bennett" <g@b4.vu>
+Date: Tue, 23 Jun 2026 02:59:04 +0930
+Subject: ALSA: FCP: Add Focusrite ISA C8X support
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+commit e0ecb324246be9cf3a0689346a658e48a38546b2 upstream.
+
+Add USB PID 0x821e to the list of devices handled by the Focusrite
+Control Protocol (FCP) driver.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Link: https://patch.msgid.link/ajlw4HK+2RSW3nUl@m.b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -4346,6 +4346,7 @@ int snd_usb_mixer_apply_create_quirk(str
+ case USB_ID(0x1235, 0x821b): /* Focusrite Scarlett 16i16 4th Gen */
+ case USB_ID(0x1235, 0x821c): /* Focusrite Scarlett 18i16 4th Gen */
+ case USB_ID(0x1235, 0x821d): /* Focusrite Scarlett 18i20 4th Gen */
++ case USB_ID(0x1235, 0x821e): /* Focusrite ISA C8X */
+ err = snd_fcp_init(mixer);
+ break;
+
--- /dev/null
+From 29b9667982e4df2ed7744f86b1144f8bb58eb698 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Sun, 21 Jun 2026 23:09:07 +0800
+Subject: ALSA: firewire: isight: bound the sample count to the packet payload
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 29b9667982e4df2ed7744f86b1144f8bb58eb698 upstream.
+
+isight_packet() takes the frame count from the device iso packet and
+checks it only against the device claimed iso length.
+
+ count = be32_to_cpu(payload->sample_count);
+ if (likely(count <= (length - 16) / 4))
+ isight_samples(isight, payload->samples, count);
+
+length is the iso header data_length. It can be up to 0xffff. So the
+gate allows a count up to about 16379. isight_samples() then copies
+count frames out of payload->samples into the PCM DMA buffer.
+
+payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The
+device multiplexes two samples per frame. A count past
+MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer
+size writes past runtime->dma_area. The smallest PCM buffer is larger
+than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET
+keeps both the read and the write in range.
+
+A malicious or faulty Apple iSight on the FireWire bus reaches this
+during a normal capture.
+
+Add the MAX_FRAMES_PER_PACKET bound to the gate.
+
+Fixes: 3a691b28a0ca ("ALSA: add Apple iSight microphone driver")
+Suggested-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Link: https://patch.msgid.link/178205454729.1900991.7807310178296762772@maoyixie.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/isight.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/firewire/isight.c
++++ b/sound/firewire/isight.c
+@@ -179,7 +179,8 @@ static void isight_packet(struct fw_iso_
+ if (likely(length >= 16 &&
+ payload->signature == cpu_to_be32(0x73676874/*"sght"*/))) {
+ count = be32_to_cpu(payload->sample_count);
+- if (likely(count <= (length - 16) / 4)) {
++ if (likely(count <= (length - 16) / 4 &&
++ count <= MAX_FRAMES_PER_PACKET)) {
+ total = be32_to_cpu(payload->sample_total);
+ if (unlikely(total != isight->total_samples)) {
+ if (!isight->first_packet)
--- /dev/null
+From c7fa99d30c7a166a5e5db5a585ce7501ff68326b Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 27 May 2026 20:09:10 +0800
+Subject: ALSA: gus: check snd_ctl_new1() return value
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit c7fa99d30c7a166a5e5db5a585ce7501ff68326b upstream.
+
+snd_ctl_new1() can return NULL when memory allocation fails.
+snd_gf1_pcm_volume_control() does not check the return value before
+dereferencing kctl->id.index, which can lead to a NULL pointer
+dereference.
+
+Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
+
+Assisted-by: Opencode:DeepSeek-V4-Flash
+Cc: stable@vger.kernel.org
+Fixes: c5ae57b1bb99 ("ALSA: gus: Fix kctl->id initialization")
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Link: https://patch.msgid.link/tencent_F644A3DCAD32945D62DB2FEEBE8A996F6809@qq.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/isa/gus/gus_pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/isa/gus/gus_pcm.c
++++ b/sound/isa/gus/gus_pcm.c
+@@ -849,6 +849,8 @@ int snd_gf1_pcm_new(struct snd_gus_card
+ kctl = snd_ctl_new1(&snd_gf1_pcm_volume_control1, gus);
+ else
+ kctl = snd_ctl_new1(&snd_gf1_pcm_volume_control, gus);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.index = control_index;
+ err = snd_ctl_add(card, kctl);
+ if (err < 0)
--- /dev/null
+From b65020d5398f499c09498c9786dba6d67ae57664 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Mon, 11 May 2026 01:29:34 -0300
+Subject: ALSA: hda/cs35l41: Fix firmware load work teardown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit b65020d5398f499c09498c9786dba6d67ae57664 upstream.
+
+cs35l41_hda creates ALSA controls whose private data points at the
+cs35l41_hda object. The firmware load control can also queue
+fw_load_work.
+
+Those controls are not removed on component unbind, and device remove
+only cancels fw_load_work through cs35l41_remove_dsp(). That helper is
+skipped when halo_initialized is false. With firmware_autostart
+disabled, a firmware load can be requested before the DSP has been
+initialized. If the component or device is removed before the queued
+work runs, the worker can run after teardown and dereference driver
+state that is no longer valid.
+
+Track the created controls and remove them on unbind so no new control
+callback can reach the driver data or queue more work. Then cancel
+fw_load_work to drain any request that was already queued. Also cancel
+the work unconditionally during device remove before runtime PM teardown.
+
+Fixes: 47ceabd99a28 ("ALSA: hda: cs35l41: Support Firmware switching and reloading")
+Fixes: 4c870513fbb0 ("ALSA: hda: cs35l41: Add read-only ALSA control for forced mute")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Reviewed-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260511-alsa-hda-cs35l41-fw-work-teardown-v1-1-1184e9bc4f25@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/side-codecs/cs35l41_hda.c | 77 ++++++++++++++++++++---------
+ sound/hda/codecs/side-codecs/cs35l41_hda.h | 5 +
+ 2 files changed, 60 insertions(+), 22 deletions(-)
+
+--- a/sound/hda/codecs/side-codecs/cs35l41_hda.c
++++ b/sound/hda/codecs/side-codecs/cs35l41_hda.c
+@@ -1328,6 +1328,43 @@ static int cs35l41_fw_type_ctl_info(stru
+ return snd_ctl_enum_info(uinfo, 1, ARRAY_SIZE(cs35l41_hda_fw_ids), cs35l41_hda_fw_ids);
+ }
+
++static void cs35l41_remove_controls(struct cs35l41_hda *cs35l41)
++{
++ if (!cs35l41->codec)
++ return;
++
++ snd_ctl_remove(cs35l41->codec->card, cs35l41->mute_override_ctl);
++ cs35l41->mute_override_ctl = NULL;
++
++ snd_ctl_remove(cs35l41->codec->card, cs35l41->fw_load_ctl);
++ cs35l41->fw_load_ctl = NULL;
++
++ snd_ctl_remove(cs35l41->codec->card, cs35l41->fw_type_ctl);
++ cs35l41->fw_type_ctl = NULL;
++}
++
++static int cs35l41_add_control(struct cs35l41_hda *cs35l41,
++ struct snd_kcontrol_new *ctl,
++ struct snd_kcontrol **kctl)
++{
++ int ret;
++
++ *kctl = snd_ctl_new1(ctl, cs35l41);
++ if (!*kctl)
++ return -ENOMEM;
++
++ ret = snd_ctl_add(cs35l41->codec->card, *kctl);
++ if (ret) {
++ dev_err(cs35l41->dev, "Failed to add KControl %s = %d\n", ctl->name, ret);
++ *kctl = NULL;
++ return ret;
++ }
++
++ dev_dbg(cs35l41->dev, "Added Control %s\n", ctl->name);
++
++ return 0;
++}
++
+ static int cs35l41_create_controls(struct cs35l41_hda *cs35l41)
+ {
+ char fw_type_ctl_name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
+@@ -1363,32 +1400,23 @@ static int cs35l41_create_controls(struc
+ scnprintf(mute_override_ctl_name, SNDRV_CTL_ELEM_ID_NAME_MAXLEN, "%s Forced Mute Status",
+ cs35l41->amp_name);
+
+- ret = snd_ctl_add(cs35l41->codec->card, snd_ctl_new1(&fw_type_ctl, cs35l41));
+- if (ret) {
+- dev_err(cs35l41->dev, "Failed to add KControl %s = %d\n", fw_type_ctl.name, ret);
+- return ret;
+- }
+-
+- dev_dbg(cs35l41->dev, "Added Control %s\n", fw_type_ctl.name);
+-
+- ret = snd_ctl_add(cs35l41->codec->card, snd_ctl_new1(&fw_load_ctl, cs35l41));
+- if (ret) {
+- dev_err(cs35l41->dev, "Failed to add KControl %s = %d\n", fw_load_ctl.name, ret);
+- return ret;
+- }
+-
+- dev_dbg(cs35l41->dev, "Added Control %s\n", fw_load_ctl.name);
++ ret = cs35l41_add_control(cs35l41, &fw_type_ctl, &cs35l41->fw_type_ctl);
++ if (ret)
++ goto err;
+
+- ret = snd_ctl_add(cs35l41->codec->card, snd_ctl_new1(&mute_override_ctl, cs35l41));
+- if (ret) {
+- dev_err(cs35l41->dev, "Failed to add KControl %s = %d\n", mute_override_ctl.name,
+- ret);
+- return ret;
+- }
++ ret = cs35l41_add_control(cs35l41, &fw_load_ctl, &cs35l41->fw_load_ctl);
++ if (ret)
++ goto err;
+
+- dev_dbg(cs35l41->dev, "Added Control %s\n", mute_override_ctl.name);
++ ret = cs35l41_add_control(cs35l41, &mute_override_ctl, &cs35l41->mute_override_ctl);
++ if (ret)
++ goto err;
+
+ return 0;
++
++err:
++ cs35l41_remove_controls(cs35l41);
++ return ret;
+ }
+
+ static bool cs35l41_dsm_supported(acpi_handle handle, unsigned int commands)
+@@ -1527,6 +1555,10 @@ static void cs35l41_hda_unbind(struct de
+ device_link_remove(&cs35l41->codec->core.dev, cs35l41->dev);
+ unlock_system_sleep(sleep_flags);
+ memset(comp, 0, sizeof(*comp));
++
++ cs35l41_remove_controls(cs35l41);
++ cancel_work_sync(&cs35l41->fw_load_work);
++ cs35l41->codec = NULL;
+ }
+ }
+
+@@ -2065,6 +2097,7 @@ void cs35l41_hda_remove(struct device *d
+ struct cs35l41_hda *cs35l41 = dev_get_drvdata(dev);
+
+ component_del(cs35l41->dev, &cs35l41_hda_comp_ops);
++ cancel_work_sync(&cs35l41->fw_load_work);
+
+ pm_runtime_get_sync(cs35l41->dev);
+ pm_runtime_dont_use_autosuspend(cs35l41->dev);
+--- a/sound/hda/codecs/side-codecs/cs35l41_hda.h
++++ b/sound/hda/codecs/side-codecs/cs35l41_hda.h
+@@ -57,6 +57,8 @@ enum control_bus {
+ SPI
+ };
+
++struct snd_kcontrol;
++
+ struct cs35l41_hda {
+ struct device *dev;
+ struct regmap *regmap;
+@@ -75,6 +77,9 @@ struct cs35l41_hda {
+ int speaker_id;
+ struct mutex fw_mutex;
+ struct work_struct fw_load_work;
++ struct snd_kcontrol *fw_type_ctl;
++ struct snd_kcontrol *fw_load_ctl;
++ struct snd_kcontrol *mute_override_ctl;
+
+ struct regmap_irq_chip_data *irq_data;
+ bool firmware_running;
--- /dev/null
+From 0ec17ee704615125c0b6e100c38129393a346bcc Mon Sep 17 00:00:00 2001
+From: Cameron Graham <cam.graham@gmail.com>
+Date: Fri, 12 Jun 2026 21:46:01 +1200
+Subject: ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
+
+From: Cameron Graham <cam.graham@gmail.com>
+
+commit 0ec17ee704615125c0b6e100c38129393a346bcc upstream.
+
+The HP EliteDesk 800 G5 Mini (PCI subsystem 103c:8595) uses
+Cannon Lake PCH cAVS HDA with DisplayPort audio pins 0x05 and
+0x06 set to AC_JACK_PORT_NONE (N/A) in BIOS defaults, causing
+hdmi_add_pin() to skip them and the DP audio device to not
+appear in ALSA.
+
+Add the board to the existing force_connect_list alongside the
+similar HP EliteDesk 800 G4 entries.
+
+Signed-off-by: Cameron Graham <cam.graham@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20260612094601.1209845-1-cam.graham@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/hdmi/hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/hda/codecs/hdmi/hdmi.c
++++ b/sound/hda/codecs/hdmi/hdmi.c
+@@ -1549,6 +1549,7 @@ static const struct snd_pci_quirk force_
+ SND_PCI_QUIRK(0x103c, 0x83e2, "HP EliteDesk 800 G4", 1),
+ SND_PCI_QUIRK(0x103c, 0x83ef, "HP MP9 G4 Retail System AMS", 1),
+ SND_PCI_QUIRK(0x103c, 0x845a, "HP EliteDesk 800 G4 DM 65W", 1),
++ SND_PCI_QUIRK(0x103c, 0x8595, "HP EliteDesk 800 G5 Mini", 1),
+ SND_PCI_QUIRK(0x103c, 0x83f3, "HP ProDesk 400", 1),
+ SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1),
+ SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
--- /dev/null
+From 958e4450e961d75bd9d8f5bfe245fb15bc78e02a Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Wed, 27 May 2026 22:08:41 +0800
+Subject: ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit 958e4450e961d75bd9d8f5bfe245fb15bc78e02a upstream.
+
+Due to a hardware defect, for Loongson PCI HDMI devices with a reversion
+ID of 2, the pin sense status must be determined via the ELD.
+
+Add a codec flag, eld_jack_detect, to indicate this case, and do special
+handlings in read_pin_sense().
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Baoqi Zhang <zhangbaoqi@loongson.cn>
+Signed-off-by: Haowei Zheng <zhenghaowei@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20260527140841.3407183-1-chenhuacai@loongson.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/hda_codec.h | 1 +
+ sound/hda/codecs/hdmi/hdmi.c | 8 +++++++-
+ sound/hda/common/jack.c | 6 ++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/include/sound/hda_codec.h
++++ b/include/sound/hda_codec.h
+@@ -259,6 +259,7 @@ struct hda_codec {
+ unsigned int forced_resume:1; /* forced resume for jack */
+ unsigned int no_stream_clean_at_suspend:1; /* do not clean streams at suspend */
+ unsigned int ctl_dev_id:1; /* old control element id build behaviour */
++ unsigned int eld_jack_detect:1; /* Machine jack-detection by ELD */
+
+ unsigned long power_on_acct;
+ unsigned long power_off_acct;
+--- a/sound/hda/codecs/hdmi/hdmi.c
++++ b/sound/hda/codecs/hdmi/hdmi.c
+@@ -2286,6 +2286,7 @@ EXPORT_SYMBOL_NS_GPL(snd_hda_hdmi_acomp_
+ enum {
+ MODEL_GENERIC,
+ MODEL_GF,
++ MODEL_LOONGSON,
+ };
+
+ static int generichdmi_probe(struct hda_codec *codec,
+@@ -2303,6 +2304,11 @@ static int generichdmi_probe(struct hda_
+ if (id->driver_data == MODEL_GF)
+ codec->no_sticky_stream = 1;
+
++ if (id->driver_data == MODEL_LOONGSON) {
++ if (codec->bus && codec->bus->pci->revision == 0x2)
++ codec->eld_jack_detect = 1; /* Jack-detection by ELD */
++ }
++
+ return 0;
+ }
+
+@@ -2320,7 +2326,7 @@ static const struct hda_codec_ops generi
+ /*
+ */
+ static const struct hda_device_id snd_hda_id_generichdmi[] = {
+- HDA_CODEC_ID_MODEL(0x00147a47, "Loongson HDMI", MODEL_GENERIC),
++ HDA_CODEC_ID_MODEL(0x00147a47, "Loongson HDMI", MODEL_LOONGSON),
+ HDA_CODEC_ID_MODEL(0x10951390, "SiI1390 HDMI", MODEL_GENERIC),
+ HDA_CODEC_ID_MODEL(0x10951392, "SiI1392 HDMI", MODEL_GENERIC),
+ HDA_CODEC_ID_MODEL(0x11069f84, "VX11 HDMI/DP", MODEL_GENERIC),
+--- a/sound/hda/common/jack.c
++++ b/sound/hda/common/jack.c
+@@ -58,6 +58,12 @@ static u32 read_pin_sense(struct hda_cod
+ AC_VERB_GET_PIN_SENSE, dev_id);
+ if (codec->inv_jack_detect)
+ val ^= AC_PINSENSE_PRESENCE;
++ if (codec->eld_jack_detect) {
++ if (val & AC_PINSENSE_ELDV)
++ val |= AC_PINSENSE_PRESENCE;
++ else
++ val &= ~AC_PINSENSE_PRESENCE;
++ }
+ return val;
+ }
+
--- /dev/null
+From 493765b8e922a506e09e22e80b6cc9ff05e8295b Mon Sep 17 00:00:00 2001
+From: Aaron Erhardt <aer@tuxedocomputers.com>
+Date: Tue, 19 May 2026 17:49:48 +0200
+Subject: ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
+
+From: Aaron Erhardt <aer@tuxedocomputers.com>
+
+commit 493765b8e922a506e09e22e80b6cc9ff05e8295b upstream.
+
+Add a PCI quirk to reduce the volume of the internal microphone to prevent
+extremely noisy signal.
+
+Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260519155047.106096-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -7290,6 +7290,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x1558, 0x51b3, "Clevo NS70AU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x5630, "Clevo NP50RNJS", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x5700, "Clevo X560WN[RST]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x6480, "Clevo V6xxAW", ALC245_FIXUP_CLEVO_NOISY_MIC),
+ SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
--- /dev/null
+From 2b929b91b0f3bc6de8a844370049cd99ee8e31ff Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 27 May 2026 20:09:11 +0800
+Subject: ALSA: ice1712: check snd_ctl_new1() return value
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit 2b929b91b0f3bc6de8a844370049cd99ee8e31ff upstream.
+
+snd_ctl_new1() can return NULL when memory allocation fails. The
+ice1712 driver calls snd_ctl_new1() without checking the return value
+before dereferencing the pointer in multiple places (ice1712.c,
+ice1724.c, aureon.c), which can lead to NULL pointer dereferences.
+
+Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
+fails.
+
+Assisted-by: Opencode:DeepSeek-V4-Flash
+Cc: stable@vger.kernel.org
+Fixes: b9a4efd61b6b ("ALSA: ice1712,ice1724: fix the kcontrol->id initialization")
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Link: https://patch.msgid.link/tencent_42E5E2AB1B6A5101F7EE8C2117F1F687BB07@qq.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/ice1712/aureon.c | 2 ++
+ sound/pci/ice1712/ice1712.c | 8 ++++++++
+ sound/pci/ice1712/ice1724.c | 6 ++++++
+ 3 files changed, 16 insertions(+)
+
+--- a/sound/pci/ice1712/aureon.c
++++ b/sound/pci/ice1712/aureon.c
+@@ -1891,6 +1891,8 @@ static int aureon_add_controls(struct sn
+ for (i = 0; i < ARRAY_SIZE(cs8415_controls); i++) {
+ struct snd_kcontrol *kctl;
+ kctl = snd_ctl_new1(&cs8415_controls[i], ice);
++ if (!kctl)
++ return -ENOMEM;
+ if (i > 1)
+ kctl->id.device = ice->pcm->device;
+ err = snd_ctl_add(ice->card, kctl);
+--- a/sound/pci/ice1712/ice1712.c
++++ b/sound/pci/ice1712/ice1712.c
+@@ -2346,21 +2346,29 @@ int snd_ice1712_spdif_build_controls(str
+ if (snd_BUG_ON(!ice->pcm_pro))
+ return -EIO;
+ kctl = snd_ctl_new1(&snd_ice1712_spdif_default, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm_pro->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_ice1712_spdif_maskc, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm_pro->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_ice1712_spdif_maskp, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm_pro->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_ice1712_spdif_stream, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm_pro->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
+--- a/sound/pci/ice1712/ice1724.c
++++ b/sound/pci/ice1712/ice1724.c
+@@ -2379,16 +2379,22 @@ static int snd_vt1724_spdif_build_contro
+ return err;
+
+ kctl = snd_ctl_new1(&snd_vt1724_spdif_default, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_vt1724_spdif_maskc, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_vt1724_spdif_maskp, ice);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = ice->pcm->device;
+ err = snd_ctl_add(ice->card, kctl);
+ if (err < 0)
--- /dev/null
+From 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Wed, 24 Jun 2026 08:38:40 +0900
+Subject: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream.
+
+snd_seq_event_dup() copies an incoming event into a pool cell and, in
+the UMP-enabled build, clears the trailing cell->ump.raw.extra word that
+the memcpy() did not cover. The guard deciding whether to clear it
+compares the copied size against sizeof(cell->event):
+
+ memcpy(&cell->ump, event, size);
+ if (size < sizeof(cell->event))
+ cell->ump.raw.extra = 0;
+
+For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==
+sizeof(cell->event), so the condition is false and the extra word keeps
+stale data. The cell pool is allocated with kvmalloc() (not zeroed) and
+cells are reused via a free list, so that word holds uninitialised heap
+or leftover event data.
+
+When such a cell is delivered to a UMP client (client->midi_version > 0)
+that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it
+unconverted -- snd_seq_read() reads it out as the larger struct
+snd_seq_ump_event and copies the stale word to user space, a 4-byte
+kernel heap infoleak to an unprivileged /dev/snd/seq client.
+
+Compare against sizeof(cell->ump) instead, so the trailing word is zeroed
+for every event shorter than the UMP cell.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -364,7 +364,7 @@ int snd_seq_event_dup(struct snd_seq_poo
+ size = snd_seq_event_packet_size(event);
+ memcpy(&cell->ump, event, size);
+ #if IS_ENABLED(CONFIG_SND_SEQ_UMP)
+- if (size < sizeof(cell->event))
++ if (size < sizeof(cell->ump))
+ cell->ump.raw.extra = 0;
+ #endif
+
--- /dev/null
+From 5cff1529a2f9b3461a7f5a6e36a86682fc290534 Mon Sep 17 00:00:00 2001
+From: WenTao Liang <vulab@iscas.ac.cn>
+Date: Sat, 27 Jun 2026 12:29:49 +0800
+Subject: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
+
+From: WenTao Liang <vulab@iscas.ac.cn>
+
+commit 5cff1529a2f9b3461a7f5a6e36a86682fc290534 upstream.
+
+In capture_urb_complete(), usb_anchor_urb() is called on every
+completion callback, but the URB is already anchored from the
+initial submission in tascam_trigger_start(). Each redundant call
+corrupts the anchor's doubly-linked list and inflates the URB
+refcount. When usb_kill_anchored_urbs() traverses the list during
+stream stop / suspend / disconnect, the corrupted list leads to
+use-after-free.
+
+Remove the redundant usb_anchor_urb() from the resubmit path.
+
+Cc: stable@vger.kernel.org
+Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding")
+Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20260627042949.61767-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/usx2y/us144mkii_capture.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/usx2y/us144mkii_capture.c
++++ b/sound/usb/usx2y/us144mkii_capture.c
+@@ -302,7 +302,6 @@ void capture_urb_complete(struct urb *ur
+ }
+
+ usb_get_urb(urb);
+- usb_anchor_urb(urb, &tascam->capture_anchor);
+ ret = usb_submit_urb(urb, GFP_ATOMIC);
+ if (ret < 0) {
+ dev_err_ratelimited(tascam->card->dev,
+@@ -312,6 +311,7 @@ void capture_urb_complete(struct urb *ur
+ usb_put_urb(urb);
+ atomic_dec(
+ &tascam->active_urbs); /* Decrement on failed resubmission */
++ return;
+ }
+ out:
+ usb_put_urb(urb);
--- /dev/null
+From 7693c0cc415f3a16a7a3355f245474a5e661be4e Mon Sep 17 00:00:00 2001
+From: Darvell Long <contact@darvell.me>
+Date: Wed, 24 Jun 2026 07:37:23 -0700
+Subject: ALSA: usb-audio: avoid kobject path lookup in DualSense match
+
+From: Darvell Long <contact@darvell.me>
+
+commit 7693c0cc415f3a16a7a3355f245474a5e661be4e upstream.
+
+The DualSense jack-detection input handler verifies that a matching input
+device belongs to the same physical controller by building kobject path
+strings for both the input device and the USB audio device, then comparing
+the path prefix.
+
+This was observed when a weak physical connection caused the controller
+to rapidly disconnect and reconnect. During that repeated hotplug,
+snd_dualsense_ih_match() can run while the controller's USB device is
+being disconnected. kobject_get_path() walks ancestor kobjects and
+dereferences their names; if the USB device kobject name is no longer
+valid, this can fault in strlen():
+
+ RIP: 0010:strlen+0x10/0x30
+ Call Trace:
+ kobject_get_path+0x34/0x150
+ snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
+ input_register_device+0x566/0x6a0
+ ps_probe+0xb89/0x1590 [hid_playstation]
+
+The same ownership check can be done without building kobject path
+strings. The input device is parented below the HID device, USB interface
+and USB device, so walking the input device parent chain and comparing
+against the mixer USB device preserves the check without dereferencing
+kobject names during disconnect.
+
+Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5")
+Cc: <stable@vger.kernel.org>
+Assisted-by: Cute:gpt-5.5
+Signed-off-by: Darvell Long <contact@darvell.me>
+Link: https://patch.msgid.link/20260624143723.2986353-1-contact@darvell.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 40 ++++++++++++----------------------------
+ 1 file changed, 12 insertions(+), 28 deletions(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -567,46 +567,30 @@ static bool snd_dualsense_ih_match(struc
+ {
+ struct dualsense_mixer_elem_info *mei;
+ struct usb_device *snd_dev;
+- char *input_dev_path, *usb_dev_path;
+- size_t usb_dev_path_len;
+- bool match = false;
++ struct device *parent;
+
+ mei = container_of(handler, struct dualsense_mixer_elem_info, ih);
+ snd_dev = mei->info.head.mixer->chip->dev;
+
+- input_dev_path = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
+- if (!input_dev_path) {
+- dev_warn(&snd_dev->dev, "Failed to get input dev path\n");
+- return false;
+- }
+-
+- usb_dev_path = kobject_get_path(&snd_dev->dev.kobj, GFP_KERNEL);
+- if (!usb_dev_path) {
+- dev_warn(&snd_dev->dev, "Failed to get USB dev path\n");
+- goto free_paths;
+- }
+-
+ /*
+ * Ensure the VID:PID matched input device supposedly owned by the
+ * hid-playstation driver belongs to the actual hardware handled by
+- * the current USB audio device, which implies input_dev_path being
+- * a subpath of usb_dev_path.
++ * the current USB audio device.
+ *
+ * This verification is necessary when there is more than one identical
+ * controller attached to the host system.
++ *
++ * The input device is registered below the HID device, USB interface and
++ * USB device, so compare the parent chain directly instead of building
++ * kobject path strings. This avoids dereferencing kobject names while the
++ * USB device hierarchy is being torn down during disconnect.
+ */
+- usb_dev_path_len = strlen(usb_dev_path);
+- if (usb_dev_path_len >= strlen(input_dev_path))
+- goto free_paths;
+-
+- usb_dev_path[usb_dev_path_len] = '/';
+- match = !memcmp(input_dev_path, usb_dev_path, usb_dev_path_len + 1);
+-
+-free_paths:
+- kfree(input_dev_path);
+- kfree(usb_dev_path);
++ for (parent = dev->dev.parent; parent; parent = parent->parent) {
++ if (parent == &snd_dev->dev)
++ return true;
++ }
+
+- return match;
++ return false;
+ }
+
+ static int snd_dualsense_ih_connect(struct input_handler *handler,
--- /dev/null
+From 0f25cf1f02e3dba626791d949c759a48c0a44996 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Sun, 19 Apr 2026 17:30:30 -0300
+Subject: ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 0f25cf1f02e3dba626791d949c759a48c0a44996 upstream.
+
+scarlett_ctl_enum_put() ignores the return value from
+snd_usb_set_cur_mix_value() and reports success whenever the
+requested enum value differs from the current one.
+
+If the SET_CUR request fails, the callback still returns success even
+though neither the hardware state nor the cached mixer value changed.
+
+Fixes: 76b188c4b370 ("ALSA: usb-audio: Scarlett mixer interface for 6i6, 18i6, 18i8 and 18i20")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-2-5a3bd4a673ae@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_scarlett.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/mixer_scarlett.c
++++ b/sound/usb/mixer_scarlett.c
+@@ -439,7 +439,9 @@ static int scarlett_ctl_enum_put(struct
+ val = ucontrol->value.integer.value[0];
+ val = val + opt->start;
+ if (val != oval) {
+- snd_usb_set_cur_mix_value(elem, 0, 0, val);
++ err = snd_usb_set_cur_mix_value(elem, 0, 0, val);
++ if (err < 0)
++ return err;
+ return 1;
+ }
+ return 0;
--- /dev/null
+From 3c06aec8abda6ba068b58a8b7119cdb2a48456b1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Sun, 19 Apr 2026 17:30:31 -0300
+Subject: ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 3c06aec8abda6ba068b58a8b7119cdb2a48456b1 upstream.
+
+Several US-16x08 mixer put callbacks log failed control URBs but
+still return success to userspace. That hides device write failures
+even though the requested value was not applied.
+
+Return the negative write error instead in the route, master, bus,
+channel, and EQ switch put callbacks.
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-3-5a3bd4a673ae@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_us16x08.c | 49 ++++++++++++++++++++++------------------------
+ 1 file changed, 24 insertions(+), 25 deletions(-)
+
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -224,14 +224,14 @@ static int snd_us16x08_route_put(struct
+
+ err = snd_us16x08_send_urb(chip, buf, sizeof(route_msg));
+
+- if (err > 0) {
+- elem->cached |= 1 << index;
+- elem->cache_val[index] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set routing, err:%d\n", err);
++ return err;
+ }
+
+- return err > 0 ? 1 : 0;
++ elem->cached |= 1 << index;
++ elem->cache_val[index] = val;
++ return 1;
+ }
+
+ static int snd_us16x08_master_info(struct snd_kcontrol *kcontrol,
+@@ -283,14 +283,14 @@ static int snd_us16x08_master_put(struct
+ buf[5] = index + 1;
+ err = snd_us16x08_send_urb(chip, buf, sizeof(mix_msg_out));
+
+- if (err > 0) {
+- elem->cached |= 1 << index;
+- elem->cache_val[index] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set master, err:%d\n", err);
++ return err;
+ }
+
+- return err > 0 ? 1 : 0;
++ elem->cached |= 1 << index;
++ elem->cache_val[index] = val;
++ return 1;
+ }
+
+ static int snd_us16x08_bus_put(struct snd_kcontrol *kcontrol,
+@@ -324,14 +324,14 @@ static int snd_us16x08_bus_put(struct sn
+ break;
+ }
+
+- if (err > 0) {
+- elem->cached |= 1;
+- elem->cache_val[0] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set bus parameter, err:%d\n", err);
++ return err;
+ }
+
+- return err > 0 ? 1 : 0;
++ elem->cached |= 1;
++ elem->cache_val[0] = val;
++ return 1;
+ }
+
+ static int snd_us16x08_bus_get(struct snd_kcontrol *kcontrol,
+@@ -392,14 +392,14 @@ static int snd_us16x08_channel_put(struc
+
+ err = snd_us16x08_send_urb(chip, buf, sizeof(mix_msg_in));
+
+- if (err > 0) {
+- elem->cached |= 1 << index;
+- elem->cache_val[index] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set channel, err:%d\n", err);
++ return err;
+ }
+
+- return err > 0 ? 1 : 0;
++ elem->cached |= 1 << index;
++ elem->cache_val[index] = val;
++ return 1;
+ }
+
+ static int snd_us16x08_mix_info(struct snd_kcontrol *kcontrol,
+@@ -529,13 +529,13 @@ static int snd_us16x08_eqswitch_put(stru
+ msleep(15);
+ }
+
+- if (err > 0) {
+- elem->cached |= 1 << index;
+- elem->cache_val[index] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set eq switch, err:%d\n", err);
++ return err;
+ }
+
++ elem->cached |= 1 << index;
++ elem->cache_val[index] = val;
+ return 1;
+ }
+
+@@ -1418,4 +1418,3 @@ int snd_us16x08_controls_create(struct u
+
+ return 0;
+ }
+-
--- /dev/null
+From 6380957fa24251856a532e48a46a4dc3d1ae26b6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 29 Apr 2026 10:20:01 -0300
+Subject: ALSA: usb-audio: Roll back quirk control caches on write errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 6380957fa24251856a532e48a46a4dc3d1ae26b6 upstream.
+
+Several mixer quirk callbacks cache the requested
+control value in kcontrol->private_value before
+issuing a single vendor or class write.
+
+Their paired get and resume paths consume that cache
+directly, so a failed write currently leaves software
+state changed even though the update did not succeed.
+That can make later reads report a value the device
+never accepted and can replay the stale cache on resume.
+
+Restore the previous cached value on failure in
+the Audigy2NX LED, Emu0204 channel switch,
+Xonar U1 output switch, Native Instruments controls,
+FTU effect program switch, and Sound Blaster E1 input source switch.
+
+Fixes: 9cf3689bfe07 ("ALSA: usb-audio: Add audigy2nx resume support")
+Fixes: 5f503ee9e270 ("ALSA: usb-audio: Add Emu0204 channel switch resume support")
+Fixes: 2bfb14c3b8fb ("ALSA: usb-audio: Add Xonar U1 resume support")
+Fixes: da6d276957ea ("ALSA: usb-audio: Add resume support for Native Instruments controls")
+Fixes: 0b4e9cfcef05 ("ALSA: usb-audio: Add resume support for FTU controls")
+Fixes: 388fdb8f882a ("ALSA: usb-audio: Support changing input on Sound Blaster E1")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260429-alsa-usb-quirks-cache-rollback-v1-1-01b35c688b80@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 45 +++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 37 insertions(+), 8 deletions(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -333,6 +333,7 @@ static int snd_audigy2nx_led_put(struct
+ int index = kcontrol->private_value & 0xff;
+ unsigned int value = ucontrol->value.integer.value[0];
+ int old_value = kcontrol->private_value >> 8;
++ unsigned long old_pval = kcontrol->private_value;
+ int err;
+
+ if (value > 1)
+@@ -341,7 +342,11 @@ static int snd_audigy2nx_led_put(struct
+ return 0;
+ kcontrol->private_value = (value << 8) | index;
+ err = snd_audigy2nx_led_update(mixer, value, index);
+- return err < 0 ? err : 1;
++ if (err < 0) {
++ kcontrol->private_value = old_pval;
++ return err;
++ }
++ return 1;
+ }
+
+ static int snd_audigy2nx_led_resume(struct usb_mixer_elem_list *list)
+@@ -487,6 +492,7 @@ static int snd_emu0204_ch_switch_put(str
+ struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
+ struct usb_mixer_interface *mixer = list->mixer;
+ unsigned int value = ucontrol->value.enumerated.item[0];
++ unsigned long old_pval = kcontrol->private_value;
+ int err;
+
+ if (value > 1)
+@@ -497,7 +503,11 @@ static int snd_emu0204_ch_switch_put(str
+
+ kcontrol->private_value = value;
+ err = snd_emu0204_ch_switch_update(mixer, value);
+- return err < 0 ? err : 1;
++ if (err < 0) {
++ kcontrol->private_value = old_pval;
++ return err;
++ }
++ return 1;
+ }
+
+ static int snd_emu0204_ch_switch_resume(struct usb_mixer_elem_list *list)
+@@ -805,7 +815,11 @@ static int snd_xonar_u1_switch_put(struc
+
+ kcontrol->private_value = new_status;
+ err = snd_xonar_u1_switch_update(list->mixer, new_status);
+- return err < 0 ? err : 1;
++ if (err < 0) {
++ kcontrol->private_value = old_status;
++ return err;
++ }
++ return 1;
+ }
+
+ static int snd_xonar_u1_switch_resume(struct usb_mixer_elem_list *list)
+@@ -1143,7 +1157,8 @@ static int snd_nativeinstruments_control
+ struct snd_ctl_elem_value *ucontrol)
+ {
+ struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
+- u8 oldval = (kcontrol->private_value >> 24) & 0xff;
++ unsigned long old_pval = kcontrol->private_value;
++ u8 oldval = (old_pval >> 24) & 0xff;
+ u8 newval = ucontrol->value.integer.value[0];
+ int err;
+
+@@ -1153,7 +1168,11 @@ static int snd_nativeinstruments_control
+ kcontrol->private_value &= ~(0xff << 24);
+ kcontrol->private_value |= (unsigned int)newval << 24;
+ err = snd_ni_update_cur_val(list);
+- return err < 0 ? err : 1;
++ if (err < 0) {
++ kcontrol->private_value = old_pval;
++ return err;
++ }
++ return 1;
+ }
+
+ static const struct snd_kcontrol_new snd_nativeinstruments_ta6_mixers[] = {
+@@ -1308,7 +1327,8 @@ static int snd_ftu_eff_switch_put(struct
+ struct snd_ctl_elem_value *ucontrol)
+ {
+ struct usb_mixer_elem_list *list = snd_kcontrol_chip(kctl);
+- unsigned int pval = list->kctl->private_value;
++ unsigned long old_pval = list->kctl->private_value;
++ unsigned int pval = old_pval;
+ int cur_val, err, new_val;
+
+ cur_val = pval >> 24;
+@@ -1319,7 +1339,11 @@ static int snd_ftu_eff_switch_put(struct
+ kctl->private_value &= ~(0xff << 24);
+ kctl->private_value |= new_val << 24;
+ err = snd_ftu_eff_switch_update(list);
+- return err < 0 ? err : 1;
++ if (err < 0) {
++ kctl->private_value = old_pval;
++ return err;
++ }
++ return 1;
+ }
+
+ static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
+@@ -2098,13 +2122,18 @@ static int snd_soundblaster_e1_switch_pu
+ {
+ struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
+ unsigned char value = !!ucontrol->value.integer.value[0];
++ unsigned long old_pval = kcontrol->private_value;
+ int err;
+
+ if (kcontrol->private_value == value)
+ return 0;
+ kcontrol->private_value = value;
+ err = snd_soundblaster_e1_switch_update(list->mixer, value);
+- return err < 0 ? err : 1;
++ if (err < 0) {
++ kcontrol->private_value = old_pval;
++ return err;
++ }
++ return 1;
+ }
+
+ static int snd_soundblaster_e1_switch_resume(struct usb_mixer_elem_list *list)
--- /dev/null
+From d8f802ccf1fdbeb89d62748d6a0d0fbd442c8127 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 29 Apr 2026 10:20:02 -0300
+Subject: ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit d8f802ccf1fdbeb89d62748d6a0d0fbd442c8127 upstream.
+
+snd_bbfpro_ctl_put() and snd_bbfpro_vol_put()
+cache the requested packed control state in
+kcontrol->private_value before issuing the USB write.
+
+Their get and resume paths use that cached value directly,
+so a failed write can leave the driver reporting and later
+replaying a setting the hardware never accepted.
+
+Update the cached state only after a successful USB write.
+
+Fixes: 3e8f3bd04716 ("ALSA: usb-audio: RME Babyface Pro mixer patch")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260429-alsa-usb-quirks-cache-rollback-v1-2-01b35c688b80@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -2905,12 +2905,14 @@ static int snd_bbfpro_ctl_put(struct snd
+ if (val == old_value)
+ return 0;
+
++ err = snd_bbfpro_ctl_update(mixer, reg, idx, val);
++ if (err < 0)
++ return err;
++
+ kcontrol->private_value = reg
+ | ((idx & SND_BBFPRO_CTL_IDX_MASK) << SND_BBFPRO_CTL_IDX_SHIFT)
+ | ((val & SND_BBFPRO_CTL_VAL_MASK) << SND_BBFPRO_CTL_VAL_SHIFT);
+-
+- err = snd_bbfpro_ctl_update(mixer, reg, idx, val);
+- return err < 0 ? err : 1;
++ return 1;
+ }
+
+ static int snd_bbfpro_ctl_resume(struct usb_mixer_elem_list *list)
+@@ -3095,11 +3097,13 @@ static int snd_bbfpro_vol_put(struct snd
+
+ new_val = uvalue & SND_BBFPRO_MIXER_VAL_MASK;
+
++ err = snd_bbfpro_vol_update(mixer, idx, new_val);
++ if (err < 0)
++ return err;
++
+ kcontrol->private_value = idx
+ | (new_val << SND_BBFPRO_MIXER_VAL_SHIFT);
+-
+- err = snd_bbfpro_vol_update(mixer, idx, new_val);
+- return err < 0 ? err : 1;
++ return 1;
+ }
+
+ static int snd_bbfpro_vol_resume(struct usb_mixer_elem_list *list)
--- /dev/null
+From a440c17869ecd71da0f295b62868fc742d09a8ba Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Sun, 19 Apr 2026 17:30:32 -0300
+Subject: ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit a440c17869ecd71da0f295b62868fc742d09a8ba upstream.
+
+snd_us16x08_comp_put() and snd_us16x08_eq_put() update their
+software stores before sending the USB write. If the transfer
+fails, later get callbacks report a value the hardware never
+accepted.
+
+Build the outgoing message from the current store plus the
+pending value, then commit the store only after a successful
+write.
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-4-5a3bd4a673ae@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_us16x08.c | 78 ++++++++++++++++++++++++++++++----------------
+ 1 file changed, 52 insertions(+), 26 deletions(-)
+
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -435,6 +435,7 @@ static int snd_us16x08_comp_put(struct s
+ int index = ucontrol->id.index;
+ char buf[sizeof(comp_msg)];
+ int val_idx, val;
++ int threshold, ratio, attack, release, gain, switch_on;
+ int err;
+
+ val = ucontrol->value.integer.value[0];
+@@ -447,36 +448,61 @@ static int snd_us16x08_comp_put(struct s
+ /* new control value incl. bias*/
+ val_idx = elem->head.id - SND_US16X08_ID_COMP_BASE;
+
+- store->val[val_idx][index] = ucontrol->value.integer.value[0];
++ threshold = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD)]
++ [index];
++ ratio = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO)][index];
++ attack = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK)][index];
++ release = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE)]
++ [index];
++ gain = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN)][index];
++ switch_on = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)]
++ [index];
++
++ switch (val_idx) {
++ case COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD):
++ threshold = val;
++ break;
++ case COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO):
++ ratio = val;
++ break;
++ case COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK):
++ attack = val;
++ break;
++ case COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE):
++ release = val;
++ break;
++ case COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN):
++ gain = val;
++ break;
++ case COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH):
++ switch_on = val;
++ break;
++ }
+
+ /* prepare compressor URB message from template */
+ memcpy(buf, comp_msg, sizeof(comp_msg));
+
+ /* place comp values in message buffer watch bias! */
+- buf[8] = store->val[
+- COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD)][index]
+- - SND_US16X08_COMP_THRESHOLD_BIAS;
+- buf[11] = ratio_map[store->val[
+- COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO)][index]];
+- buf[14] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK)][index]
+- + SND_US16X08_COMP_ATTACK_BIAS;
+- buf[17] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE)][index]
+- + SND_US16X08_COMP_RELEASE_BIAS;
+- buf[20] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN)][index];
+- buf[26] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)][index];
++ buf[8] = threshold - SND_US16X08_COMP_THRESHOLD_BIAS;
++ buf[11] = ratio_map[ratio];
++ buf[14] = attack + SND_US16X08_COMP_ATTACK_BIAS;
++ buf[17] = release + SND_US16X08_COMP_RELEASE_BIAS;
++ buf[20] = gain;
++ buf[26] = switch_on;
+
+ /* place channel selector in message buffer */
+ buf[5] = index + 1;
+
+ err = snd_us16x08_send_urb(chip, buf, sizeof(comp_msg));
+
+- if (err > 0) {
+- elem->cached |= 1 << index;
+- elem->cache_val[index] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set compressor, err:%d\n", err);
++ return err;
+ }
+
++ store->val[val_idx][index] = val;
++ elem->cached |= 1 << index;
++ elem->cache_val[index] = val;
+ return 1;
+ }
+
+@@ -578,11 +604,10 @@ static int snd_us16x08_eq_put(struct snd
+ /* copy URB buffer from EQ template */
+ memcpy(buf, eqs_msq, sizeof(eqs_msq));
+
+- store->val[b_idx][p_idx][index] = val;
+- buf[20] = store->val[b_idx][3][index];
+- buf[17] = store->val[b_idx][2][index];
+- buf[14] = store->val[b_idx][1][index];
+- buf[11] = store->val[b_idx][0][index];
++ buf[20] = p_idx == 3 ? val : store->val[b_idx][3][index];
++ buf[17] = p_idx == 2 ? val : store->val[b_idx][2][index];
++ buf[14] = p_idx == 1 ? val : store->val[b_idx][1][index];
++ buf[11] = p_idx == 0 ? val : store->val[b_idx][0][index];
+
+ /* place channel index in URB buffer */
+ buf[5] = index + 1;
+@@ -592,14 +617,15 @@ static int snd_us16x08_eq_put(struct snd
+
+ err = snd_us16x08_send_urb(chip, buf, sizeof(eqs_msq));
+
+- if (err > 0) {
+- /* store new value in EQ band cache */
+- elem->cached |= 1 << index;
+- elem->cache_val[index] = val;
+- } else {
++ if (err < 0) {
+ usb_audio_dbg(chip, "Failed to set eq param, err:%d\n", err);
++ return err;
+ }
+
++ store->val[b_idx][p_idx][index] = val;
++ /* store new value in EQ band cache */
++ elem->cached |= 1 << index;
++ elem->cache_val[index] = val;
+ return 1;
+ }
+
alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch
alsa-virtio-validate-control-metadata-from-the-device.patch
alsa-ymfpci-check-snd_ctl_new1-return-value.patch
+alsa-aoa-check-snd_ctl_new1-return-value.patch
+alsa-caiaq-fix-out-of-bounds-read-in-the-traktor-kontrol-s4-input-parser.patch
+alsa-cmipci-check-snd_ctl_new1-return-value.patch
+alsa-compress-fix-task-creation-error-unwind.patch
+alsa-es1938-check-snd_ctl_new1-return-value.patch
+alsa-fcp-add-focusrite-isa-c8x-support.patch
+alsa-firewire-isight-bound-the-sample-count-to-the-packet-payload.patch
+alsa-gus-check-snd_ctl_new1-return-value.patch
+alsa-hda-cs35l41-fix-firmware-load-work-teardown.patch
+alsa-hda-hdmi-add-force-connect-quirk-for-hp-elitedesk-800-g5-mini.patch
+alsa-hda-hdmi-use-ac_pinsense_eldv-to-detect-pinsense-for-loongson.patch
+alsa-hda-realtek-fix-noisy-mic-for-clevo-v6xxaw.patch
+alsa-ice1712-check-snd_ctl_new1-return-value.patch
+alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch
+alsa-us144mkii-capture_urb_complete-redundant-usb_anchor_urb-corrupts-anchor-list-on-each-resubmission.patch
+alsa-usb-audio-avoid-kobject-path-lookup-in-dualsense-match.patch
+alsa-usb-audio-propagate-errors-in-scarlett_ctl_enum_put.patch
+alsa-usb-audio-propagate-us-16x08-write-errors-in-route-mix-eq-switch-put-callbacks.patch
+alsa-usb-audio-roll-back-quirk-control-caches-on-write-errors.patch
+alsa-usb-audio-update-babyface-pro-control-caches-only-after-successful-writes.patch
+alsa-usb-audio-update-us-16x08-eq-comp-shadow-state-after-successful-writes.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
