From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 15:21:42 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1a6e6b3d66a58d4a357b987a748da66f7de92b87;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: alsa-seq-check-ump-support-for-midi_version-change.patch alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch alsa-seq-skip-event-type-filtering-for-ump-events.patch iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch iio-invensense-fix-odr-switching-to-same-value.patch --- diff --git a/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch b/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch index 2c4fd42258..707c369df6 100644 --- a/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch +++ b/queue-5.15/alsa-seq-avoid-confusion-of-aligned-read-size.patch @@ -23,14 +23,12 @@ Link: https://lore.kernel.org/r/20230605144758.6677-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- - sound/core/seq/seq_clientmgr.c | 2 +- + sound/core/seq/seq_clientmgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 948ae45e0cc3..e3f9ea67d019 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c -@@ -451,7 +451,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count, +@@ -441,7 +441,7 @@ static ssize_t snd_seq_read(struct file err = 0; snd_seq_fifo_lock(fifo); @@ -39,6 +37,3 @@ index 948ae45e0cc3..e3f9ea67d019 100644 aligned_size = sizeof(struct snd_seq_ump_event); else aligned_size = sizeof(struct snd_seq_event); --- -2.55.0 - diff --git a/queue-5.15/alsa-seq-check-ump-support-for-midi_version-change.patch b/queue-5.15/alsa-seq-check-ump-support-for-midi_version-change.patch new file mode 100644 index 0000000000..bc1fafe28b --- /dev/null +++ b/queue-5.15/alsa-seq-check-ump-support-for-midi_version-change.patch @@ -0,0 +1,46 @@ +From 8765429279e7d3d68d39ace5f84af2815174bb1e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 31 Dec 2024 15:53:58 +0100 +Subject: ALSA: seq: Check UMP support for midi_version change + +From: Takashi Iwai + +commit 8765429279e7d3d68d39ace5f84af2815174bb1e upstream. + +When the kernel is built without UMP support but a user-space app +requires the midi_version > 0, the kernel should return an error. +Otherwise user-space assumes as if it were possible to deal, +eventually hitting serious errors later. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Cc: +Link: https://patch.msgid.link/20241231145358.21946-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_clientmgr.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -1330,10 +1330,16 @@ static int snd_seq_ioctl_set_client_info + if (client->type != client_info->type) + return -EINVAL; + +- /* check validity of midi_version field */ +- if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3) && +- client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0) +- return -EINVAL; ++ if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3)) { ++ /* check validity of midi_version field */ ++ if (client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0) ++ return -EINVAL; ++ ++ /* check if UMP is supported in kernel */ ++ if (!IS_ENABLED(CONFIG_SND_SEQ_UMP) && ++ client_info->midi_version > 0) ++ return -EINVAL; ++ } + + /* fill the info fields */ + if (client_info->name[0]) diff --git a/queue-5.15/alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch b/queue-5.15/alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch new file mode 100644 index 0000000000..75cfbdd3b9 --- /dev/null +++ b/queue-5.15/alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch @@ -0,0 +1,55 @@ +From 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Wed, 24 Jun 2026 08:38:40 +0900 +Subject: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() + +From: HyeongJun An + +commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream. + +snd_seq_event_dup() copies an incoming event into a pool cell and, in +the UMP-enabled build, clears the trailing cell->ump.raw.extra word that +the memcpy() did not cover. The guard deciding whether to clear it +compares the copied size against sizeof(cell->event): + + memcpy(&cell->ump, event, size); + if (size < sizeof(cell->event)) + cell->ump.raw.extra = 0; + +For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == +sizeof(cell->event), so the condition is false and the extra word keeps +stale data. The cell pool is allocated with kvmalloc() (not zeroed) and +cells are reused via a free list, so that word holds uninitialised heap +or leftover event data. + +When such a cell is delivered to a UMP client (client->midi_version > 0) +that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it +unconverted -- snd_seq_read() reads it out as the larger struct +snd_seq_ump_event and copies the stale word to user space, a 4-byte +kernel heap infoleak to an unprivileged /dev/snd/seq client. + +Compare against sizeof(cell->ump) instead, so the trailing word is zeroed +for every event shorter than the UMP cell. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -309,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo + size = snd_seq_event_packet_size(event); + memcpy(&cell->ump, event, size); + #if IS_ENABLED(CONFIG_SND_SEQ_UMP) +- if (size < sizeof(cell->event)) ++ if (size < sizeof(cell->ump)) + cell->ump.raw.extra = 0; + #endif + diff --git a/queue-5.15/alsa-seq-skip-event-type-filtering-for-ump-events.patch b/queue-5.15/alsa-seq-skip-event-type-filtering-for-ump-events.patch new file mode 100644 index 0000000000..5796dc8d88 --- /dev/null +++ b/queue-5.15/alsa-seq-skip-event-type-filtering-for-ump-events.patch @@ -0,0 +1,34 @@ +From 32108c22ac619c32dd6db594319e259b63bfb387 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 19 Aug 2024 10:41:53 +0200 +Subject: ALSA: seq: Skip event type filtering for UMP events + +From: Takashi Iwai + +commit 32108c22ac619c32dd6db594319e259b63bfb387 upstream. + +UMP events don't use the event type field, hence it's invalid to apply +the filter, which may drop the events unexpectedly. +Skip the event filtering for UMP events, instead. + +Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") +Cc: +Link: https://patch.msgid.link/20240819084156.10286-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_clientmgr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -528,6 +528,9 @@ static struct snd_seq_client *get_event_ + return NULL; + if (! dest->accept_input) + goto __not_avail; ++ if (snd_seq_ev_is_ump(event)) ++ return dest; /* ok - no filter checks */ ++ + if ((dest->filter & SNDRV_SEQ_FILTER_USE_EVENT) && + ! test_bit(event->type, dest->event_filter)) + goto __not_avail; diff --git a/queue-5.15/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch b/queue-5.15/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch new file mode 100644 index 0000000000..9d96e8ba1c --- /dev/null +++ b/queue-5.15/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch @@ -0,0 +1,55 @@ +From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Tue, 23 Jun 2026 16:22:15 +0200 +Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value + +From: Jean-Baptiste Maneyrol + +commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream. + +Clock period value is used for computing periods of sampling. There is +no need for it to be higher than the maximum odr, otherwise we are +losing precision in the computation for nothing. + +Switch clock period value to maximum odr period (8kHz). + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++-- + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +@@ -720,10 +720,10 @@ struct iio_dev *inv_icm42600_accel_init( + return ERR_PTR(-ENOMEM); + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + ts = iio_priv(indio_dev); +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +@@ -731,10 +731,10 @@ struct iio_dev *inv_icm42600_gyro_init(s + return ERR_PTR(-ENOMEM); + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + ts = iio_priv(indio_dev); diff --git a/queue-5.15/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch b/queue-5.15/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch new file mode 100644 index 0000000000..12c2a18b6c --- /dev/null +++ b/queue-5.15/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch @@ -0,0 +1,45 @@ +From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Mon, 19 Feb 2024 15:47:41 +0000 +Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off + +From: Jean-Baptiste Maneyrol + +commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream. + +Track correctly FIFO state and apply ODR change before starting +the chip. Without the fix, you cannot change ODR more than 1 time +when data buffering is off. This restriction on a single pending ODR +change should only apply when the FIFO is on. + +Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +@@ -111,6 +111,7 @@ int inv_mpu6050_prepare_fifo(struct inv_ + if (enable) { + /* reset timestamping */ + inv_sensors_timestamp_reset(&st->timestamp); ++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0); + /* reset FIFO */ + d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST; + ret = regmap_write(st->map, st->reg->user_ctrl, d); +@@ -184,6 +185,10 @@ static int inv_mpu6050_set_enable(struct + if (result) + goto error_power_off; + } else { ++ st->chip_config.gyro_fifo_enable = 0; ++ st->chip_config.accl_fifo_enable = 0; ++ st->chip_config.temp_fifo_enable = 0; ++ st->chip_config.magn_fifo_enable = 0; + result = inv_mpu6050_prepare_fifo(st, false); + if (result) + goto error_power_off; diff --git a/queue-5.15/iio-invensense-fix-odr-switching-to-same-value.patch b/queue-5.15/iio-invensense-fix-odr-switching-to-same-value.patch new file mode 100644 index 0000000000..cf49075df1 --- /dev/null +++ b/queue-5.15/iio-invensense-fix-odr-switching-to-same-value.patch @@ -0,0 +1,46 @@ +From 95444b9eeb8c5c0330563931d70c61ca3b101548 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Fri, 24 May 2024 12:48:51 +0000 +Subject: iio: invensense: fix odr switching to same value + +From: Jean-Baptiste Maneyrol + +commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream. + +ODR switching happens in 2 steps, update to store the new value and then +apply when the ODR change flag is received in the data. When switching to +the same ODR value, the ODR change flag is never happening, and frequency +switching is blocked waiting for the never coming apply. + +Fix the issue by preventing update to happen when switching to same ODR +value. + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c ++++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c +@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta + int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts, + uint32_t period, bool fifo) + { ++ uint32_t mult; ++ + /* when FIFO is on, prevent odr change if one is already pending */ + if (fifo && ts->new_mult != 0) + return -EAGAIN; + +- ts->new_mult = period / ts->chip.clock_period; ++ mult = period / ts->chip.clock_period; ++ if (mult != ts->mult) ++ ts->new_mult = mult; + + return 0; + } diff --git a/queue-5.15/series b/queue-5.15/series index 561199d594..34a6416876 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -835,3 +835,9 @@ posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch alsa-seq-avoid-confusion-of-aligned-read-size.patch +iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch +iio-invensense-fix-odr-switching-to-same-value.patch +alsa-seq-skip-event-type-filtering-for-ump-events.patch +alsa-seq-check-ump-support-for-midi_version-change.patch +iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch +alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch