Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
- sound/core/seq/seq_clientmgr.c | 2 +-
+ sound/core/seq/seq_clientmgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
-index 948ae45e0cc3..e3f9ea67d019 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
-@@ -451,7 +451,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
+@@ -441,7 +441,7 @@ static ssize_t snd_seq_read(struct file
err = 0;
snd_seq_fifo_lock(fifo);
aligned_size = sizeof(struct snd_seq_ump_event);
else
aligned_size = sizeof(struct snd_seq_event);
---
-2.55.0
-
--- /dev/null
+From 8765429279e7d3d68d39ace5f84af2815174bb1e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 31 Dec 2024 15:53:58 +0100
+Subject: ALSA: seq: Check UMP support for midi_version change
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8765429279e7d3d68d39ace5f84af2815174bb1e upstream.
+
+When the kernel is built without UMP support but a user-space app
+requires the midi_version > 0, the kernel should return an error.
+Otherwise user-space assumes as if it were possible to deal,
+eventually hitting serious errors later.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20241231145358.21946-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_clientmgr.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1330,10 +1330,16 @@ static int snd_seq_ioctl_set_client_info
+ if (client->type != client_info->type)
+ return -EINVAL;
+
+- /* check validity of midi_version field */
+- if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3) &&
+- client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0)
+- return -EINVAL;
++ if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3)) {
++ /* check validity of midi_version field */
++ if (client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0)
++ return -EINVAL;
++
++ /* check if UMP is supported in kernel */
++ if (!IS_ENABLED(CONFIG_SND_SEQ_UMP) &&
++ client_info->midi_version > 0)
++ return -EINVAL;
++ }
+
+ /* fill the info fields */
+ if (client_info->name[0])
--- /dev/null
+From 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Wed, 24 Jun 2026 08:38:40 +0900
+Subject: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream.
+
+snd_seq_event_dup() copies an incoming event into a pool cell and, in
+the UMP-enabled build, clears the trailing cell->ump.raw.extra word that
+the memcpy() did not cover. The guard deciding whether to clear it
+compares the copied size against sizeof(cell->event):
+
+ memcpy(&cell->ump, event, size);
+ if (size < sizeof(cell->event))
+ cell->ump.raw.extra = 0;
+
+For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==
+sizeof(cell->event), so the condition is false and the extra word keeps
+stale data. The cell pool is allocated with kvmalloc() (not zeroed) and
+cells are reused via a free list, so that word holds uninitialised heap
+or leftover event data.
+
+When such a cell is delivered to a UMP client (client->midi_version > 0)
+that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it
+unconverted -- snd_seq_read() reads it out as the larger struct
+snd_seq_ump_event and copies the stale word to user space, a 4-byte
+kernel heap infoleak to an unprivileged /dev/snd/seq client.
+
+Compare against sizeof(cell->ump) instead, so the trailing word is zeroed
+for every event shorter than the UMP cell.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -309,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo
+ size = snd_seq_event_packet_size(event);
+ memcpy(&cell->ump, event, size);
+ #if IS_ENABLED(CONFIG_SND_SEQ_UMP)
+- if (size < sizeof(cell->event))
++ if (size < sizeof(cell->ump))
+ cell->ump.raw.extra = 0;
+ #endif
+
--- /dev/null
+From 32108c22ac619c32dd6db594319e259b63bfb387 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 19 Aug 2024 10:41:53 +0200
+Subject: ALSA: seq: Skip event type filtering for UMP events
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 32108c22ac619c32dd6db594319e259b63bfb387 upstream.
+
+UMP events don't use the event type field, hence it's invalid to apply
+the filter, which may drop the events unexpectedly.
+Skip the event filtering for UMP events, instead.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20240819084156.10286-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_clientmgr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -528,6 +528,9 @@ static struct snd_seq_client *get_event_
+ return NULL;
+ if (! dest->accept_input)
+ goto __not_avail;
++ if (snd_seq_ev_is_ump(event))
++ return dest; /* ok - no filter checks */
++
+ if ((dest->filter & SNDRV_SEQ_FILTER_USE_EVENT) &&
+ ! test_bit(event->type, dest->event_filter))
+ goto __not_avail;
--- /dev/null
+From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Tue, 23 Jun 2026 16:22:15 +0200
+Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
+
+Clock period value is used for computing periods of sampling. There is
+no need for it to be higher than the maximum odr, otherwise we are
+losing precision in the computation for nothing.
+
+Switch clock period value to maximum odr period (8kHz).
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++--
+ drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+@@ -720,10 +720,10 @@ struct iio_dev *inv_icm42600_accel_init(
+ return ERR_PTR(-ENOMEM);
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ ts = iio_priv(indio_dev);
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+@@ -731,10 +731,10 @@ struct iio_dev *inv_icm42600_gyro_init(s
+ return ERR_PTR(-ENOMEM);
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ ts = iio_priv(indio_dev);
--- /dev/null
+From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Mon, 19 Feb 2024 15:47:41 +0000
+Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream.
+
+Track correctly FIFO state and apply ODR change before starting
+the chip. Without the fix, you cannot change ODR more than 1 time
+when data buffering is off. This restriction on a single pending ODR
+change should only apply when the FIFO is on.
+
+Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+@@ -111,6 +111,7 @@ int inv_mpu6050_prepare_fifo(struct inv_
+ if (enable) {
+ /* reset timestamping */
+ inv_sensors_timestamp_reset(&st->timestamp);
++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
+ /* reset FIFO */
+ d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
+ ret = regmap_write(st->map, st->reg->user_ctrl, d);
+@@ -184,6 +185,10 @@ static int inv_mpu6050_set_enable(struct
+ if (result)
+ goto error_power_off;
+ } else {
++ st->chip_config.gyro_fifo_enable = 0;
++ st->chip_config.accl_fifo_enable = 0;
++ st->chip_config.temp_fifo_enable = 0;
++ st->chip_config.magn_fifo_enable = 0;
+ result = inv_mpu6050_prepare_fifo(st, false);
+ if (result)
+ goto error_power_off;
--- /dev/null
+From 95444b9eeb8c5c0330563931d70c61ca3b101548 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Fri, 24 May 2024 12:48:51 +0000
+Subject: iio: invensense: fix odr switching to same value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream.
+
+ODR switching happens in 2 steps, update to store the new value and then
+apply when the ODR change flag is received in the data. When switching to
+the same ODR value, the ODR change flag is never happening, and frequency
+switching is blocked waiting for the never coming apply.
+
+Fix the issue by preventing update to happen when switching to same ODR
+value.
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
++++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta
+ int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
+ uint32_t period, bool fifo)
+ {
++ uint32_t mult;
++
+ /* when FIFO is on, prevent odr change if one is already pending */
+ if (fifo && ts->new_mult != 0)
+ return -EAGAIN;
+
+- ts->new_mult = period / ts->chip.clock_period;
++ mult = period / ts->chip.clock_period;
++ if (mult != ts->mult)
++ ts->new_mult = mult;
+
+ return 0;
+ }
kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch
bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch
alsa-seq-avoid-confusion-of-aligned-read-size.patch
+iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch
+iio-invensense-fix-odr-switching-to-same-value.patch
+alsa-seq-skip-event-type-filtering-for-ump-events.patch
+alsa-seq-check-ump-support-for-midi_version-change.patch
+iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch
+alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
