--- /dev/null
+From 5ed060d5491597490fb53ec69da3edc4b1e8c165 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Tue, 31 Mar 2026 18:14:04 -0300
+Subject: ALSA: aoa: i2sbus: clear stale prepared state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 5ed060d5491597490fb53ec69da3edc4b1e8c165 upstream.
+
+The i2sbus PCM code uses pi->active to constrain the sibling stream to
+an already prepared duplex format and rate in i2sbus_pcm_open().
+
+That state is set from i2sbus_pcm_prepare(), but the current code only
+clears it on close. As a result, the sibling stream can inherit stale
+constraints after the prepared state has been torn down.
+
+Clear pi->active when hw_params() or hw_free() tears down the prepared
+state, and set it again only after prepare succeeds.
+
+Replace the stale FIXME in the duplex constraint comment with a description
+of the current driver behavior: i2sbus still programs a single shared
+transport configuration for both directions, so mixed formats are not
+supported in duplex mode.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202604010125.AvkWBYKI-lkp@intel.com/
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260331-aoa-i2sbus-clear-stale-active-v2-1-3764ae2889a1@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/aoa/soundbus/i2sbus/pcm.c | 55 ++++++++++++++++++++++++++++++++--------
+ 1 file changed, 44 insertions(+), 11 deletions(-)
+
+--- a/sound/aoa/soundbus/i2sbus/pcm.c
++++ b/sound/aoa/soundbus/i2sbus/pcm.c
+@@ -165,17 +165,16 @@ static int i2sbus_pcm_open(struct i2sbus
+ * currently in use (if any). */
+ hw->rate_min = 5512;
+ hw->rate_max = 192000;
+- /* if the other stream is active, then we can only
+- * support what it is currently using.
+- * FIXME: I lied. This comment is wrong. We can support
+- * anything that works with the same serial format, ie.
+- * when recording 24 bit sound we can well play 16 bit
+- * sound at the same time iff using the same transfer mode.
++ /* If the other stream is already prepared, keep this stream
++ * on the same duplex format and rate.
++ *
++ * i2sbus_pcm_prepare() still programs one shared transport
++ * configuration for both directions, so mixed duplex formats
++ * are not supported here.
+ */
+ if (other->active) {
+- /* FIXME: is this guaranteed by the alsa api? */
+ hw->formats &= pcm_format_to_bits(i2sdev->format);
+- /* see above, restrict rates to the one we already have */
++ /* Restrict rates to the one already in use. */
+ hw->rate_min = i2sdev->rate;
+ hw->rate_max = i2sdev->rate;
+ }
+@@ -283,6 +282,23 @@ void i2sbus_wait_for_stop_both(struct i2
+ }
+ #endif
+
++static void i2sbus_pcm_clear_active(struct i2sbus_dev *i2sdev, int in)
++{
++ struct pcm_info *pi;
++
++ guard(mutex)(&i2sdev->lock);
++
++ get_pcm_info(i2sdev, in, &pi, NULL);
++ pi->active = 0;
++}
++
++static inline int i2sbus_hw_params(struct snd_pcm_substream *substream,
++ struct snd_pcm_hw_params *params, int in)
++{
++ i2sbus_pcm_clear_active(snd_pcm_substream_chip(substream), in);
++ return 0;
++}
++
+ static inline int i2sbus_hw_free(struct snd_pcm_substream *substream, int in)
+ {
+ struct i2sbus_dev *i2sdev = snd_pcm_substream_chip(substream);
+@@ -291,14 +307,27 @@ static inline int i2sbus_hw_free(struct
+ get_pcm_info(i2sdev, in, &pi, NULL);
+ if (pi->dbdma_ring.stopping)
+ i2sbus_wait_for_stop(i2sdev, pi);
++ i2sbus_pcm_clear_active(i2sdev, in);
+ return 0;
+ }
+
++static int i2sbus_playback_hw_params(struct snd_pcm_substream *substream,
++ struct snd_pcm_hw_params *params)
++{
++ return i2sbus_hw_params(substream, params, 0);
++}
++
+ static int i2sbus_playback_hw_free(struct snd_pcm_substream *substream)
+ {
+ return i2sbus_hw_free(substream, 0);
+ }
+
++static int i2sbus_record_hw_params(struct snd_pcm_substream *substream,
++ struct snd_pcm_hw_params *params)
++{
++ return i2sbus_hw_params(substream, params, 1);
++}
++
+ static int i2sbus_record_hw_free(struct snd_pcm_substream *substream)
+ {
+ return i2sbus_hw_free(substream, 1);
+@@ -335,7 +364,6 @@ static int i2sbus_pcm_prepare(struct i2s
+ return -EINVAL;
+
+ runtime = pi->substream->runtime;
+- pi->active = 1;
+ if (other->active &&
+ ((i2sdev->format != runtime->format)
+ || (i2sdev->rate != runtime->rate)))
+@@ -450,9 +478,11 @@ static int i2sbus_pcm_prepare(struct i2s
+
+ /* early exit if already programmed correctly */
+ /* not locking these is fine since we touch them only in this function */
+- if (in_le32(&i2sdev->intfregs->serial_format) == sfr
+- && in_le32(&i2sdev->intfregs->data_word_sizes) == dws)
++ if (in_le32(&i2sdev->intfregs->serial_format) == sfr &&
++ in_le32(&i2sdev->intfregs->data_word_sizes) == dws) {
++ pi->active = 1;
+ return 0;
++ }
+
+ /* let's notify the codecs about clocks going away.
+ * For now we only do mastering on the i2s cell... */
+@@ -490,6 +520,7 @@ static int i2sbus_pcm_prepare(struct i2s
+ if (cii->codec->switch_clock)
+ cii->codec->switch_clock(cii, CLOCK_SWITCH_SLAVE);
+
++ pi->active = 1;
+ return 0;
+ }
+
+@@ -734,6 +765,7 @@ static snd_pcm_uframes_t i2sbus_playback
+ static const struct snd_pcm_ops i2sbus_playback_ops = {
+ .open = i2sbus_playback_open,
+ .close = i2sbus_playback_close,
++ .hw_params = i2sbus_playback_hw_params,
+ .hw_free = i2sbus_playback_hw_free,
+ .prepare = i2sbus_playback_prepare,
+ .trigger = i2sbus_playback_trigger,
+@@ -802,6 +834,7 @@ static snd_pcm_uframes_t i2sbus_record_p
+ static const struct snd_pcm_ops i2sbus_record_ops = {
+ .open = i2sbus_record_open,
+ .close = i2sbus_record_close,
++ .hw_params = i2sbus_record_hw_params,
+ .hw_free = i2sbus_record_hw_free,
+ .prepare = i2sbus_record_prepare,
+ .trigger = i2sbus_record_trigger,
--- /dev/null
+From 4ec93f070eda6b765b62efcaed9241c3b3b0b6ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Mon, 30 Mar 2026 01:00:34 -0300
+Subject: ALSA: aoa: i2sbus: fix OF node lifetime handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 4ec93f070eda6b765b62efcaed9241c3b3b0b6ad upstream.
+
+i2sbus_add_dev() keeps the matched "sound" child pointer after
+for_each_child_of_node() has dropped the iterator reference. Take an
+extra reference before saving that node and drop it after the
+layout-id/device-id lookup is complete.
+
+The function also stores np in dev->sound.ofdev.dev.of_node without
+taking a reference for the embedded soundbus device. Since i2sbus
+overrides the embedded platform device release callback, balance that
+reference explicitly in the local error path and in i2sbus_release_dev().
+
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260330-aoa-i2sbus-ofnode-lifetime-v1-1-51c309f4ff06@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/aoa/soundbus/i2sbus/core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/sound/aoa/soundbus/i2sbus/core.c
++++ b/sound/aoa/soundbus/i2sbus/core.c
+@@ -84,6 +84,7 @@ static void i2sbus_release_dev(struct de
+ for (i = aoa_resource_i2smmio; i <= aoa_resource_rxdbdma; i++)
+ free_irq(i2sdev->interrupts[i], i2sdev);
+ i2sbus_control_remove_dev(i2sdev->control, i2sdev);
++ of_node_put(i2sdev->sound.ofdev.dev.of_node);
+ mutex_destroy(&i2sdev->lock);
+ kfree(i2sdev);
+ }
+@@ -147,7 +148,6 @@ static int i2sbus_get_and_fixup_rsrc(str
+ }
+
+ /* Returns 1 if added, 0 for otherwise; don't return a negative value! */
+-/* FIXME: look at device node refcounting */
+ static int i2sbus_add_dev(struct macio_dev *macio,
+ struct i2sbus_control *control,
+ struct device_node *np)
+@@ -178,8 +178,9 @@ static int i2sbus_add_dev(struct macio_d
+ i = 0;
+ for_each_child_of_node(np, child) {
+ if (of_node_name_eq(child, "sound")) {
++ of_node_put(sound);
+ i++;
+- sound = child;
++ sound = of_node_get(child);
+ }
+ }
+ if (i == 1) {
+@@ -205,6 +206,7 @@ static int i2sbus_add_dev(struct macio_d
+ }
+ }
+ }
++ of_node_put(sound);
+ /* for the time being, until we can handle non-layout-id
+ * things in some fabric, refuse to attach if there is no
+ * layout-id property or we haven't been forced to attach.
+@@ -219,7 +221,7 @@ static int i2sbus_add_dev(struct macio_d
+ mutex_init(&dev->lock);
+ spin_lock_init(&dev->low_lock);
+ dev->sound.ofdev.archdata.dma_mask = macio->ofdev.archdata.dma_mask;
+- dev->sound.ofdev.dev.of_node = np;
++ dev->sound.ofdev.dev.of_node = of_node_get(np);
+ dev->sound.ofdev.dev.dma_mask = &dev->sound.ofdev.archdata.dma_mask;
+ dev->sound.ofdev.dev.parent = &macio->ofdev.dev;
+ dev->sound.ofdev.dev.release = i2sbus_release_dev;
+@@ -327,6 +329,7 @@ static int i2sbus_add_dev(struct macio_d
+ for (i=0;i<3;i++)
+ release_and_free_resource(dev->allocated_resource[i]);
+ mutex_destroy(&dev->lock);
++ of_node_put(dev->sound.ofdev.dev.of_node);
+ kfree(dev);
+ return 0;
+ }
--- /dev/null
+From fd7df93013c5118812e63a52635dc6c3a805a1de Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Tue, 10 Mar 2026 11:29:20 +0100
+Subject: ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit fd7df93013c5118812e63a52635dc6c3a805a1de upstream.
+
+In i2sbus_resume(), skip devices with an empty codec list, which avoids
+using an uninitialized 'sysclock_factor' in the 32-bit format path in
+i2sbus_pcm_prepare().
+
+In i2sbus_pcm_prepare(), replace two list_for_each_entry() loops with a
+single list_first_entry() now that the codec list is guaranteed to be
+non-empty by all callers.
+
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Link: https://patch.msgid.link/20260310102921.210109-3-thorsten.blum@linux.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/aoa/soundbus/i2sbus/core.c | 3 +++
+ sound/aoa/soundbus/i2sbus/pcm.c | 16 +++++-----------
+ 2 files changed, 8 insertions(+), 11 deletions(-)
+
+--- a/sound/aoa/soundbus/i2sbus/core.c
++++ b/sound/aoa/soundbus/i2sbus/core.c
+@@ -408,6 +408,9 @@ static int i2sbus_resume(struct macio_de
+ int err, ret = 0;
+
+ list_for_each_entry(i2sdev, &control->list, item) {
++ if (list_empty(&i2sdev->sound.codec_list))
++ continue;
++
+ /* reset i2s bus format etc. */
+ i2sbus_pcm_prepare_both(i2sdev);
+
+--- a/sound/aoa/soundbus/i2sbus/pcm.c
++++ b/sound/aoa/soundbus/i2sbus/pcm.c
+@@ -411,6 +411,9 @@ static int i2sbus_pcm_prepare(struct i2s
+ /* set stop command */
+ command->command = cpu_to_le16(DBDMA_STOP);
+
++ cii = list_first_entry(&i2sdev->sound.codec_list,
++ struct codec_info_item, list);
++
+ /* ok, let's set the serial format and stuff */
+ switch (runtime->format) {
+ /* 16 bit formats */
+@@ -418,13 +421,7 @@ static int i2sbus_pcm_prepare(struct i2s
+ case SNDRV_PCM_FORMAT_U16_BE:
+ /* FIXME: if we add different bus factors we need to
+ * do more here!! */
+- bi.bus_factor = 0;
+- list_for_each_entry(cii, &i2sdev->sound.codec_list, list) {
+- bi.bus_factor = cii->codec->bus_factor;
+- break;
+- }
+- if (!bi.bus_factor)
+- return -ENODEV;
++ bi.bus_factor = cii->codec->bus_factor;
+ input_16bit = 1;
+ break;
+ case SNDRV_PCM_FORMAT_S32_BE:
+@@ -438,10 +435,7 @@ static int i2sbus_pcm_prepare(struct i2s
+ return -EINVAL;
+ }
+ /* we assume all sysclocks are the same! */
+- list_for_each_entry(cii, &i2sdev->sound.codec_list, list) {
+- bi.sysclock_factor = cii->codec->sysclock_factor;
+- break;
+- }
++ bi.sysclock_factor = cii->codec->sysclock_factor;
+
+ if (clock_and_divisors(bi.sysclock_factor,
+ bi.bus_factor,
--- /dev/null
+From 7d61662197ecdc458e33e475b6ada7f6da61d364 Mon Sep 17 00:00:00 2001
+From: Harin Lee <me@harin.net>
+Date: Mon, 6 Apr 2026 16:49:13 +0900
+Subject: ALSA: ctxfi: Add fallback to default RSR for S/PDIF
+
+From: Harin Lee <me@harin.net>
+
+commit 7d61662197ecdc458e33e475b6ada7f6da61d364 upstream.
+
+spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR
+for the MSR calculation loop. However, pll_rate is only updated in
+atc_pll_init() and not in hw_pll_init(), so it remains 0 after the
+card init.
+
+When spdif_passthru_playback_setup() skips atc_pll_init() for
+32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin
+indefinitely.
+
+Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects
+the hardware state, since hw_card_init() already configures the PLL
+to the default RSR.
+
+Fixes: 8cc72361481f ("ALSA: SB X-Fi driver merge")
+Cc: stable@vger.kernel.org
+Signed-off-by: Harin Lee <me@harin.net>
+Link: https://patch.msgid.link/20260406074913.217374-1-me@harin.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/ctxfi/ctatc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/ctxfi/ctatc.c
++++ b/sound/pci/ctxfi/ctatc.c
+@@ -788,7 +788,8 @@ static int spdif_passthru_playback_get_r
+ struct src *src;
+ int err;
+ int n_amixer = apcm->substream->runtime->channels, i;
+- unsigned int pitch, rsr = atc->pll_rate;
++ unsigned int pitch;
++ unsigned int rsr = atc->pll_rate ? atc->pll_rate : atc->rsr;
+
+ /* first release old resources */
+ atc_pcm_release_resources(atc, apcm);
--- /dev/null
+From bbc6c0dda54fc0ad8f8aed0b796c23e186e1a188 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Tue, 24 Mar 2026 16:59:41 -0300
+Subject: ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit bbc6c0dda54fc0ad8f8aed0b796c23e186e1a188 upstream.
+
+snd_seq_oss_write() currently returns the raw load_patch() callback
+result for SEQ_FULLSIZE events.
+
+That callback is documented as returning 0 on success and -errno on
+failure, but snd_seq_oss_write() is the file write path and should
+report the number of user bytes consumed on success. Some in-tree
+backends also return backend-specific positive values, which can still
+be shorter than the original write size.
+
+Return the full byte count for successful SEQ_FULLSIZE writes.
+Preserve negative errors and convert any nonnegative completion to the
+original count.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260324-alsa-seq-oss-fullsize-write-return-v1-1-66d448510538@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/oss/seq_oss_rw.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/core/seq/oss/seq_oss_rw.c
++++ b/sound/core/seq/oss/seq_oss_rw.c
+@@ -101,9 +101,9 @@ snd_seq_oss_write(struct seq_oss_devinfo
+ break;
+ }
+ fmt = (*(unsigned short *)rec.c) & 0xffff;
+- /* FIXME the return value isn't correct */
+- return snd_seq_oss_synth_load_patch(dp, rec.s.dev,
+- fmt, buf, 0, count);
++ err = snd_seq_oss_synth_load_patch(dp, rec.s.dev,
++ fmt, buf, 0, count);
++ return err < 0 ? err : count;
+ }
+ if (ev_is_long(&rec)) {
+ /* extended code */
net-qrtr-ns-fix-use-after-free-in-driver-remove.patch
ext2-reject-inodes-with-zero-i_nlink-and-valid-mode-in-ext2_iget.patch
mm-zsmalloc-copy-kmsan-metadata-in-zs_page_migrate.patch
+alsa-aoa-i2sbus-clear-stale-prepared-state.patch
+alsa-aoa-i2sbus-fix-of-node-lifetime-handling.patch
+alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch
+alsa-ctxfi-add-fallback-to-default-rsr-for-s-pdif.patch
+alsa-seq_oss-return-full-count-for-successful-seq_fullsize-writes.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
