From: Greg Kroah-Hartman Date: Mon, 13 Apr 2026 13:47:26 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=08d7e46d9a6bab8844b3ebfaa9d4148609121816;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch asoc-tegra-fix-master-volume-control.patch netlink-add-nla-be16-32-types-to-minlen-array.patch xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch --- diff --git a/queue-5.10/asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch b/queue-5.10/asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch new file mode 100644 index 0000000000..99fb17980c --- /dev/null +++ b/queue-5.10/asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch @@ -0,0 +1,34 @@ +From 640eac4c849d6390f272862ba8db14f28d423670 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Tue, 8 Jun 2021 09:11:50 +0900 +Subject: ASoC: soc-core: don't use discriminatory terms on snd_soc_runtime_get_dai_fmt() + +From: Kuninori Morimoto + +commit 640eac4c849d6390f272862ba8db14f28d423670 upstream. + +snd_soc_runtime_get_dai_fmt() is using discriminatory terms. +This patch fixup it. + +Fixes: ba9e82a1c891 ("ASoC: soc-core: add snd_soc_runtime_get_dai_fmt()") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/874ke9dxkp.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1209,8 +1209,8 @@ found: + mask |= SND_SOC_DAIFMT_CLOCK_MASK; + if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_INV_MASK)) + mask |= SND_SOC_DAIFMT_INV_MASK; +- if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_MASTER_MASK)) +- mask |= SND_SOC_DAIFMT_MASTER_MASK; ++ if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK)) ++ mask |= SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK; + + dai_link->dai_fmt |= (dai_fmt & mask); + } diff --git a/queue-5.10/asoc-tegra-fix-master-volume-control.patch b/queue-5.10/asoc-tegra-fix-master-volume-control.patch new file mode 100644 index 0000000000..0e992b45ff --- /dev/null +++ b/queue-5.10/asoc-tegra-fix-master-volume-control.patch @@ -0,0 +1,36 @@ +From f9fd804aa0a36f15a35ca070ec4c52650876cc29 Mon Sep 17 00:00:00 2001 +From: Jon Hunter +Date: Tue, 13 Jun 2023 10:34:53 +0100 +Subject: ASoC: tegra: Fix Master Volume Control + +From: Jon Hunter + +commit f9fd804aa0a36f15a35ca070ec4c52650876cc29 upstream. + +Commit 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations") corrected +the PCM wait_time calculations and in doing so reduced the calculated +wait_time. This exposed an issue with the Tegra Master Volume Control +(MVC) device where the reduced wait_time caused the MVC to fail. For now +fix this by setting the default wait_time for Tegra to be 500ms. + +Fixes: 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations") +Signed-off-by: Jon Hunter +Link: https://lore.kernel.org/r/20230613093453.13927-1-jonathanh@nvidia.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/tegra/tegra_pcm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/soc/tegra/tegra_pcm.c ++++ b/sound/soc/tegra/tegra_pcm.c +@@ -111,6 +111,9 @@ int tegra_pcm_open(struct snd_soc_compon + return ret; + } + ++ /* Set wait time to 500ms by default */ ++ substream->wait_time = 500; ++ + return 0; + } + EXPORT_SYMBOL_GPL(tegra_pcm_open); diff --git a/queue-5.10/netlink-add-nla-be16-32-types-to-minlen-array.patch b/queue-5.10/netlink-add-nla-be16-32-types-to-minlen-array.patch new file mode 100644 index 0000000000..789af66fae --- /dev/null +++ b/queue-5.10/netlink-add-nla-be16-32-types-to-minlen-array.patch @@ -0,0 +1,60 @@ +From 9a0d18853c280f6a0ee99f91619f2442a17a323a Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 21 Feb 2024 18:27:33 +0100 +Subject: netlink: add nla be16/32 types to minlen array + +From: Florian Westphal + +commit 9a0d18853c280f6a0ee99f91619f2442a17a323a upstream. + +BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] +BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] +BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] +BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 + nla_validate_range_unsigned lib/nlattr.c:222 [inline] + nla_validate_int_range lib/nlattr.c:336 [inline] + validate_nla lib/nlattr.c:575 [inline] +... + +The message in question matches this policy: + + [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), + +but because NLA_BE32 size in minlen array is 0, the validation +code will read past the malformed (too small) attribute. + +Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: +those likely should be added too. + +Reported-by: syzbot+3f497b07aa3baf2fb4d0@syzkaller.appspotmail.com +Reported-by: xingwei lee +Closes: https://lore.kernel.org/all/CABOYnLzFYHSnvTyS6zGa-udNX55+izqkOt2sB9WDqUcEGW6n8w@mail.gmail.com/raw +Fixes: ecaf75ffd5f5 ("netlink: introduce bigendian integer types") +Signed-off-by: Florian Westphal +Link: https://lore.kernel.org/r/20240221172740.5092-1-fw@strlen.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + lib/nlattr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -30,6 +30,8 @@ static const u8 nla_attr_len[NLA_TYPE_MA + [NLA_S16] = sizeof(s16), + [NLA_S32] = sizeof(s32), + [NLA_S64] = sizeof(s64), ++ [NLA_BE16] = sizeof(__be16), ++ [NLA_BE32] = sizeof(__be32), + }; + + static const u8 nla_attr_minlen[NLA_TYPE_MAX+1] = { +@@ -43,6 +45,8 @@ static const u8 nla_attr_minlen[NLA_TYPE + [NLA_S16] = sizeof(s16), + [NLA_S32] = sizeof(s32), + [NLA_S64] = sizeof(s64), ++ [NLA_BE16] = sizeof(__be16), ++ [NLA_BE32] = sizeof(__be32), + }; + + /* diff --git a/queue-5.10/series b/queue-5.10/series index fd04ad3d82..ef32c85e16 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -454,3 +454,7 @@ mmc-vub300-fix-null-deref-on-disconnect.patch net-qualcomm-qca_uart-report-the-consumed-byte-on-rx-skb-allocation-failure.patch net-stmmac-fix-integer-underflow-in-chain-mode.patch rxrpc-fix-key-keyring-checks-in-setsockopt-rxrpc_security_key-keyring.patch +xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch +asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch +asoc-tegra-fix-master-volume-control.patch +netlink-add-nla-be16-32-types-to-minlen-array.patch diff --git a/queue-5.10/xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch b/queue-5.10/xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch new file mode 100644 index 0000000000..d11e968718 --- /dev/null +++ b/queue-5.10/xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch @@ -0,0 +1,42 @@ +From cd7e1fef5a1ca1c4fcd232211962ac2395601636 Mon Sep 17 00:00:00 2001 +From: GuoHan Zhao +Date: Wed, 25 Mar 2026 20:02:46 +0800 +Subject: xen/privcmd: unregister xenstore notifier on module exit + +From: GuoHan Zhao + +commit cd7e1fef5a1ca1c4fcd232211962ac2395601636 upstream. + +Commit 453b8fb68f36 ("xen/privcmd: restrict usage in +unprivileged domU") added a xenstore notifier to defer setting the +restriction target until Xenstore is ready. + +XEN_PRIVCMD can be built as a module, but privcmd_exit() leaves that +notifier behind. Balance the notifier lifecycle by unregistering it on +module exit. + +This is harmless even if xenstore was already ready at registration +time and the notifier was never queued on the chain. + +Fixes: 453b8fb68f3641fe ("xen/privcmd: restrict usage in unprivileged domU") +Signed-off-by: GuoHan Zhao +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20260325120246.252899-1-zhaoguohan@kylinos.cn> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/privcmd.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/xen/privcmd.c ++++ b/drivers/xen/privcmd.c +@@ -1069,6 +1069,9 @@ static int __init privcmd_init(void) + + static void __exit privcmd_exit(void) + { ++ if (!xen_initial_domain()) ++ unregister_xenstore_notifier(&xenstore_notifier); ++ + misc_deregister(&privcmd_dev); + misc_deregister(&xen_privcmdbuf_dev); + }