--- /dev/null
+From 8d70503068510e6080c2c649cccb154f16de26c9 Mon Sep 17 00:00:00 2001
+From: Ed Burcher <git@edburcher.com>
+Date: Mon, 19 May 2025 23:49:07 +0100
+Subject: ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
+
+From: Ed Burcher <git@edburcher.com>
+
+commit 8d70503068510e6080c2c649cccb154f16de26c9 upstream.
+
+Lenovo Yoga Pro 7 (gen 10) with Realtek ALC3306 and combined CS35L56
+amplifiers need quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to
+enable bass
+
+Signed-off-by: Ed Burcher <git@edburcher.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250519224907.31265-2-git@edburcher.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9549,6 +9549,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+ SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
++ SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
--- /dev/null
+From 93a81ca0657758b607c3f4ba889ae806be9beb73 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 16 May 2025 10:08:16 +0200
+Subject: ALSA: pcm: Fix race of buffer access at PCM OSS layer
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream.
+
+The PCM OSS layer tries to clear the buffer with the silence data at
+initialization (or reconfiguration) of a stream with the explicit call
+of snd_pcm_format_set_silence() with runtime->dma_area. But this may
+lead to a UAF because the accessed runtime->dma_area might be freed
+concurrently, as it's performed outside the PCM ops.
+
+For avoiding it, move the code into the PCM core and perform it inside
+the buffer access lock, so that it won't be changed during the
+operation.
+
+Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/pcm.h | 2 ++
+ sound/core/oss/pcm_oss.c | 3 +--
+ sound/core/pcm_native.c | 11 +++++++++++
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -1334,6 +1334,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
+ #define snd_pcm_lib_mmap_iomem NULL
+ #endif
+
++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
++
+ /**
+ * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
+ * @dma: DMA number
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1078,8 +1078,7 @@ static int snd_pcm_oss_change_params_loc
+ runtime->oss.params = 0;
+ runtime->oss.prepare = 1;
+ runtime->oss.buffer_used = 0;
+- if (runtime->dma_area)
+- snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes));
++ snd_pcm_runtime_buffer_set_silence(runtime);
+
+ runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size);
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -685,6 +685,17 @@ static void snd_pcm_buffer_access_unlock
+ atomic_inc(&runtime->buffer_accessing);
+ }
+
++/* fill the PCM buffer with the current silence format; called from pcm_oss.c */
++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
++{
++ snd_pcm_buffer_access_lock(runtime);
++ if (runtime->dma_area)
++ snd_pcm_format_set_silence(runtime->format, runtime->dma_area,
++ bytes_to_samples(runtime, runtime->dma_bytes));
++ snd_pcm_buffer_access_unlock(runtime);
++}
++EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence);
++
+ #if IS_ENABLED(CONFIG_SND_PCM_OSS)
+ #define is_oss_stream(substream) ((substream)->oss.oss)
+ #else
--- /dev/null
+From 239af1970bcb039a1551d2c438d113df0010c149 Mon Sep 17 00:00:00 2001
+From: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Date: Thu, 15 May 2025 12:20:15 +0000
+Subject: llc: fix data loss when reading from a socket in llc_ui_recvmsg()
+
+From: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+
+commit 239af1970bcb039a1551d2c438d113df0010c149 upstream.
+
+For SOCK_STREAM sockets, if user buffer size (len) is less
+than skb size (skb->len), the remaining data from skb
+will be lost after calling kfree_skb().
+
+To fix this, move the statement for partial reading
+above skb deletion.
+
+Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org)
+
+Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/af_llc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -887,15 +887,15 @@ static int llc_ui_recvmsg(struct socket
+ if (sk->sk_type != SOCK_STREAM)
+ goto copy_uaddr;
+
++ /* Partial read */
++ if (used + offset < skb_len)
++ continue;
++
+ if (!(flags & MSG_PEEK)) {
+ skb_unlink(skb, &sk->sk_receive_queue);
+ kfree_skb(skb);
+ *seq = 0;
+ }
+-
+- /* Partial read */
+- if (used + offset < skb_len)
+- continue;
+ } while (len > 0);
+
+ out:
padata-do-not-leak-refcount-in-reorder_work.patch
can-bcm-add-locking-for-bcm_op-runtime-updates.patch
can-bcm-add-missing-rcu-read-protection-for-procfs-content.patch
+alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch
+alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch
+llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
