From: Greg Kroah-Hartman Date: Fri, 1 May 2026 11:55:42 +0000 (+0200) Subject: 7.0-stable patches X-Git-Tag: v6.12.86~54 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=710747c11917df66b9e0fc1c7b4a748387263fa2;p=thirdparty%2Fkernel%2Fstable-queue.git 7.0-stable patches added patches: alsa-6fire-fix-input-volume-change-detection.patch alsa-caiaq-fix-control_put-result-and-cache-rollback.patch alsa-caiaq-handle-probe-errors-properly.patch alsa-core-fix-potential-data-race-at-fasync-handling.patch alsa-hda-realtek-add-mute-led-support-for-hp-victus-15-fa2xxx.patch alsa-pcmtest-fix-reference-leak-on-failed-device-registration.patch alsa-pcmtest-fix-resource-leaks-in-module-init-error-paths.patch iio-adc-ad7768-1-fix-one-shot-mode-data-acquisition.patch iio-adc-ad7768-1-remove-switch-to-one-shot-mode.patch --- diff --git a/queue-7.0/alsa-6fire-fix-input-volume-change-detection.patch b/queue-7.0/alsa-6fire-fix-input-volume-change-detection.patch new file mode 100644 index 0000000000..5c39ed0ce2 --- /dev/null +++ b/queue-7.0/alsa-6fire-fix-input-volume-change-detection.patch @@ -0,0 +1,58 @@ +From dc88eef8f55e85e92d016cdf7e291f5560efd79b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Thu, 16 Apr 2026 10:24:40 -0300 +Subject: ALSA: 6fire: Fix input volume change detection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit dc88eef8f55e85e92d016cdf7e291f5560efd79b upstream. + +usb6fire_control_input_vol_put() stores the analog capture volume +as a signed offset in rt->input_vol[] (-15..+15), but it compares +the cached value against the user-visible mixer value (0..30) +before subtracting 15. + +This mixes two domains in the change detection path. Since the +runtime is zero-initialized, the visible default is 15; writing 0 +right after probe is ignored, while writing 15 is reported as a +change even though the cached value remains 0. + +Normalize the user value before comparing it with the cached offset. + +Fixes: 06bb4e743501 ("ALSA: snd-usb-6fire: add analog input volume control") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260416-alsa-6fire-input-volume-change-detection-v1-1-ec78299168df@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/6fire/control.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/sound/usb/6fire/control.c ++++ b/sound/usb/6fire/control.c +@@ -290,15 +290,17 @@ static int usb6fire_control_input_vol_pu + struct snd_ctl_elem_value *ucontrol) + { + struct control_runtime *rt = snd_kcontrol_chip(kcontrol); ++ int vol0 = ucontrol->value.integer.value[0] - 15; ++ int vol1 = ucontrol->value.integer.value[1] - 15; + int changed = 0; + +- if (rt->input_vol[0] != ucontrol->value.integer.value[0]) { +- rt->input_vol[0] = ucontrol->value.integer.value[0] - 15; ++ if (rt->input_vol[0] != vol0) { ++ rt->input_vol[0] = vol0; + rt->ivol_updated &= ~(1 << 0); + changed = 1; + } +- if (rt->input_vol[1] != ucontrol->value.integer.value[1]) { +- rt->input_vol[1] = ucontrol->value.integer.value[1] - 15; ++ if (rt->input_vol[1] != vol1) { ++ rt->input_vol[1] = vol1; + rt->ivol_updated &= ~(1 << 1); + changed = 1; + } diff --git a/queue-7.0/alsa-caiaq-fix-control_put-result-and-cache-rollback.patch b/queue-7.0/alsa-caiaq-fix-control_put-result-and-cache-rollback.patch new file mode 100644 index 0000000000..8d77c9b2c1 --- /dev/null +++ b/queue-7.0/alsa-caiaq-fix-control_put-result-and-cache-rollback.patch @@ -0,0 +1,124 @@ +From a3542d1b30f92307f545f2def14e8d988dffdff0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Fri, 17 Apr 2026 10:41:33 -0300 +Subject: ALSA: caiaq: Fix control_put() result and cache rollback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit a3542d1b30f92307f545f2def14e8d988dffdff0 upstream. + +control_put() always returns 1 and updates cdev->control_state[] +before sending the USB command. It also ignores transport errors +from usb_bulk_msg(), snd_usb_caiaq_send_command(), and +snd_usb_caiaq_send_command_bank(). + +That breaks the ALSA .put() contract and can leave control_get() +reporting a cached value the device never accepted. + +Return 0 for unchanged values, propagate transport failures, +and restore the cached byte when the write fails. + +Fixes: 8e3cd08ed8e59 ("[ALSA] caiaq - add control API and more input features") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260417-caiaq-control-put-v1-1-c37826e92447@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/caiaq/control.c | 54 +++++++++++++++++++++++++++++++--------------- + 1 file changed, 37 insertions(+), 17 deletions(-) + +--- a/sound/usb/caiaq/control.c ++++ b/sound/usb/caiaq/control.c +@@ -87,6 +87,7 @@ static int control_put(struct snd_kcontr + struct snd_usb_caiaqdev *cdev = caiaqdev(chip->card); + int pos = kcontrol->private_value; + int v = ucontrol->value.integer.value[0]; ++ int ret; + unsigned char cmd; + + switch (cdev->chip.usb_id) { +@@ -103,6 +104,10 @@ static int control_put(struct snd_kcontr + + if (pos & CNT_INTVAL) { + int i = pos & ~CNT_INTVAL; ++ unsigned char old = cdev->control_state[i]; ++ ++ if (old == v) ++ return 0; + + cdev->control_state[i] = v; + +@@ -113,10 +118,11 @@ static int control_put(struct snd_kcontr + cdev->ep8_out_buf[0] = i; + cdev->ep8_out_buf[1] = v; + +- usb_bulk_msg(cdev->chip.dev, +- usb_sndbulkpipe(cdev->chip.dev, 8), +- cdev->ep8_out_buf, sizeof(cdev->ep8_out_buf), +- &actual_len, 200); ++ ret = usb_bulk_msg(cdev->chip.dev, ++ usb_sndbulkpipe(cdev->chip.dev, 8), ++ cdev->ep8_out_buf, ++ sizeof(cdev->ep8_out_buf), ++ &actual_len, 200); + } else if (cdev->chip.usb_id == + USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_MASCHINECONTROLLER)) { + +@@ -128,21 +134,36 @@ static int control_put(struct snd_kcontr + offset = MASCHINE_BANK_SIZE; + } + +- snd_usb_caiaq_send_command_bank(cdev, cmd, bank, +- cdev->control_state + offset, +- MASCHINE_BANK_SIZE); ++ ret = snd_usb_caiaq_send_command_bank(cdev, cmd, bank, ++ cdev->control_state + offset, ++ MASCHINE_BANK_SIZE); + } else { +- snd_usb_caiaq_send_command(cdev, cmd, +- cdev->control_state, sizeof(cdev->control_state)); ++ ret = snd_usb_caiaq_send_command(cdev, cmd, ++ cdev->control_state, ++ sizeof(cdev->control_state)); + } +- } else { +- if (v) +- cdev->control_state[pos / 8] |= 1 << (pos % 8); +- else +- cdev->control_state[pos / 8] &= ~(1 << (pos % 8)); + +- snd_usb_caiaq_send_command(cdev, cmd, +- cdev->control_state, sizeof(cdev->control_state)); ++ if (ret < 0) { ++ cdev->control_state[i] = old; ++ return ret; ++ } ++ } else { ++ int idx = pos / 8; ++ unsigned char mask = 1 << (pos % 8); ++ unsigned char old = cdev->control_state[idx]; ++ unsigned char val = v ? (old | mask) : (old & ~mask); ++ ++ if (old == val) ++ return 0; ++ ++ cdev->control_state[idx] = val; ++ ret = snd_usb_caiaq_send_command(cdev, cmd, ++ cdev->control_state, ++ sizeof(cdev->control_state)); ++ if (ret < 0) { ++ cdev->control_state[idx] = old; ++ return ret; ++ } + } + + return 1; +@@ -640,4 +661,3 @@ int snd_usb_caiaq_control_init(struct sn + + return ret; + } +- diff --git a/queue-7.0/alsa-caiaq-handle-probe-errors-properly.patch b/queue-7.0/alsa-caiaq-handle-probe-errors-properly.patch new file mode 100644 index 0000000000..a65ae06065 --- /dev/null +++ b/queue-7.0/alsa-caiaq-handle-probe-errors-properly.patch @@ -0,0 +1,125 @@ +From 28abd224db4a49560b452115bca3672a20e45b2f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 14 Apr 2026 12:59:00 +0200 +Subject: ALSA: caiaq: Handle probe errors properly + +From: Takashi Iwai + +commit 28abd224db4a49560b452115bca3672a20e45b2f upstream. + +The probe procedure of setup_card() in caiaq driver doesn't treat the +error cases gracefully, e.g. the error from snd_card_register() calls +snd_card_free() but continues. This would lead to a UAF for the +further calls like snd_usb_caiaq_control_init(), as Berk suggested in +another patch in the link below. + +However, the problem is not only that; in general, this function drops +the all error handlings (as it's a void function) although its caller +can propagate an error to snd_probe(), which eventually calls +snd_card_free() as a proper error path. That said, we should treat +each error case in setup_card(), and just return the error code +promptly, which is then handled later as a fatal error in snd_probe(). + +This patch achieves it by changing the setup_card() to return an error +code. Also, the superfluous snd_card_free() call is removed, too. + +Note that card->private_free can be set still safely at returning an +error. All called functions in card_free() have checks of the +unassigned resources or NULL checks. + +Fixes: 8e3cd08ed8e5 ("[ALSA] caiaq - add control API and more input features") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/20260413034941.1131465-2-berkcgoksel@gmail.com +Link: https://patch.msgid.link/20260414105916.364073-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/caiaq/device.c | 33 ++++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +--- a/sound/usb/caiaq/device.c ++++ b/sound/usb/caiaq/device.c +@@ -290,7 +290,7 @@ int snd_usb_caiaq_set_auto_msg(struct sn + tmp, sizeof(tmp)); + } + +-static void setup_card(struct snd_usb_caiaqdev *cdev) ++static int setup_card(struct snd_usb_caiaqdev *cdev) + { + int ret; + char val[4]; +@@ -325,8 +325,10 @@ static void setup_card(struct snd_usb_ca + snd_usb_caiaq_send_command(cdev, EP1_CMD_READ_IO, NULL, 0); + + if (!wait_event_timeout(cdev->ep1_wait_queue, +- cdev->control_state[0] != 0xff, HZ)) +- return; ++ cdev->control_state[0] != 0xff, HZ)) { ++ dev_err(dev, "Read timeout for control state\n"); ++ return -EINVAL; ++ } + + /* fix up some defaults */ + if ((cdev->control_state[1] != 2) || +@@ -347,33 +349,43 @@ static void setup_card(struct snd_usb_ca + cdev->spec.num_digital_audio_out + + cdev->spec.num_digital_audio_in > 0) { + ret = snd_usb_caiaq_audio_init(cdev); +- if (ret < 0) ++ if (ret < 0) { + dev_err(dev, "Unable to set up audio system (ret=%d)\n", ret); ++ return ret; ++ } + } + + if (cdev->spec.num_midi_in + + cdev->spec.num_midi_out > 0) { + ret = snd_usb_caiaq_midi_init(cdev); +- if (ret < 0) ++ if (ret < 0) { + dev_err(dev, "Unable to set up MIDI system (ret=%d)\n", ret); ++ return ret; ++ } + } + + #ifdef CONFIG_SND_USB_CAIAQ_INPUT + ret = snd_usb_caiaq_input_init(cdev); +- if (ret < 0) ++ if (ret < 0) { + dev_err(dev, "Unable to set up input system (ret=%d)\n", ret); ++ return ret; ++ } + #endif + + /* finally, register the card and all its sub-instances */ + ret = snd_card_register(cdev->chip.card); + if (ret < 0) { + dev_err(dev, "snd_card_register() returned %d\n", ret); +- snd_card_free(cdev->chip.card); ++ return ret; + } + + ret = snd_usb_caiaq_control_init(cdev); +- if (ret < 0) ++ if (ret < 0) { + dev_err(dev, "Unable to set up control system (ret=%d)\n", ret); ++ return ret; ++ } ++ ++ return 0; + } + + static void card_free(struct snd_card *card) +@@ -499,8 +511,11 @@ static int init_card(struct snd_usb_caia + scnprintf(card->longname, sizeof(card->longname), "%s %s (%s)", + cdev->vendor_name, cdev->product_name, usbpath); + +- setup_card(cdev); + card->private_free = card_free; ++ err = setup_card(cdev); ++ if (err < 0) ++ return err; ++ + return 0; + + err_kill_urb: diff --git a/queue-7.0/alsa-core-fix-potential-data-race-at-fasync-handling.patch b/queue-7.0/alsa-core-fix-potential-data-race-at-fasync-handling.patch new file mode 100644 index 0000000000..944ec3b931 --- /dev/null +++ b/queue-7.0/alsa-core-fix-potential-data-race-at-fasync-handling.patch @@ -0,0 +1,70 @@ +From 8146cd333d235ed32d48bb803fdf743472d7c783 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 20 Apr 2026 08:17:20 +0200 +Subject: ALSA: core: Fix potential data race at fasync handling + +From: Takashi Iwai + +commit 8146cd333d235ed32d48bb803fdf743472d7c783 upstream. + +In snd_fasync_work_fn(), which is the offload work for traversing and +processing the pending fasync list, the call of kill_fasync() is done +outside the snd_fasync_lock for avoiding deadlocks. The problem is +that its the references of fasync->on, fasync->signal and fasync->poll +are done there also outside the lock. Since these may be modified by +snd_kill_fasync() call concurrently from other process, inconsistent +values might be passed to kill_fasync(). Although there shouldn't be +critical UAF, it's still better to be addressed. + +This patch moves the kill_fasync() argument evaluations inside the +snd_fasync_lock for avoiding the data races above. The handling in +fasync->on flag is optimized in the loop to skip directly. + +Also, for more clarity, snd_fasync_free() takes the lock and unlink +the pending entry more directly instead of clearing fasync->on flag. + +Reported-by: Jake Lamberson +Fixes: ef34a0ae7a26 ("ALSA: core: Add async signal helpers") +Cc: +Link: https://patch.msgid.link/20260420061721.3253644-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/misc.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/sound/core/misc.c ++++ b/sound/core/misc.c +@@ -100,14 +100,18 @@ static LIST_HEAD(snd_fasync_list); + static void snd_fasync_work_fn(struct work_struct *work) + { + struct snd_fasync *fasync; ++ int signal, poll; + + spin_lock_irq(&snd_fasync_lock); + while (!list_empty(&snd_fasync_list)) { + fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list); + list_del_init(&fasync->list); ++ if (!fasync->on) ++ continue; ++ signal = fasync->signal; ++ poll = fasync->poll; + spin_unlock_irq(&snd_fasync_lock); +- if (fasync->on) +- kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); ++ kill_fasync(&fasync->fasync, signal, poll); + spin_lock_irq(&snd_fasync_lock); + } + spin_unlock_irq(&snd_fasync_lock); +@@ -158,7 +162,10 @@ void snd_fasync_free(struct snd_fasync * + { + if (!fasync) + return; +- fasync->on = 0; ++ ++ scoped_guard(spinlock_irq, &snd_fasync_lock) ++ list_del_init(&fasync->list); ++ + flush_work(&snd_fasync_work); + kfree(fasync); + } diff --git a/queue-7.0/alsa-hda-realtek-add-mute-led-support-for-hp-victus-15-fa2xxx.patch b/queue-7.0/alsa-hda-realtek-add-mute-led-support-for-hp-victus-15-fa2xxx.patch new file mode 100644 index 0000000000..c77a3ed40f --- /dev/null +++ b/queue-7.0/alsa-hda-realtek-add-mute-led-support-for-hp-victus-15-fa2xxx.patch @@ -0,0 +1,35 @@ +From eacda758e3c01db98b5c231f56cf9a6e05ced75c Mon Sep 17 00:00:00 2001 +From: Spencer Payton +Date: Tue, 21 Apr 2026 10:49:18 +0200 +Subject: ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx + +From: Spencer Payton + +commit eacda758e3c01db98b5c231f56cf9a6e05ced75c upstream. + +The mute LED on this laptop uses ALC245 but requires a quirk to work. +This patch enables the existing ALC245_FIXUP_HP_MUTE_LED_COEFBIT +quirk for the device. + +Tested my Victus 15-fa2xxx (PCI SSID 103c:8dcd). +The LED behaviour works as intended. + +Cc: stable@vger.kernel.org +Signed-off-by: Spencer Payton +Link: https://patch.msgid.link/20260421084918.14685-1-spayton681@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -7153,6 +7153,7 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x103c, 0x8d90, "HP EliteBook 16 G12", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8d91, "HP ZBook Firefly 14 G12", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8d92, "HP ZBook Firefly 16 G12", ALC285_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8dcd, "HP Victus 15-fa2xxx", ALC245_FIXUP_HP_MUTE_LED_COEFBIT), + SND_PCI_QUIRK(0x103c, 0x8d9b, "HP 17 Turbine OmniBook 7 UMA", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8d9c, "HP 17 Turbine OmniBook 7 DIS", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x103c, 0x8d9d, "HP 17 Turbine OmniBook X UMA", ALC287_FIXUP_CS35L41_I2C_2), diff --git a/queue-7.0/alsa-pcmtest-fix-reference-leak-on-failed-device-registration.patch b/queue-7.0/alsa-pcmtest-fix-reference-leak-on-failed-device-registration.patch new file mode 100644 index 0000000000..f2ccc76f95 --- /dev/null +++ b/queue-7.0/alsa-pcmtest-fix-reference-leak-on-failed-device-registration.patch @@ -0,0 +1,50 @@ +From 4ff036f95238f02c87e5d7c0a9d93748582a8950 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Thu, 16 Apr 2026 03:31:38 +0800 +Subject: ALSA: pcmtest: fix reference leak on failed device registration + +From: Guangshuo Li + +commit 4ff036f95238f02c87e5d7c0a9d93748582a8950 upstream. + +When platform_device_register() fails in mod_init(), the embedded struct +device in pcmtst_pdev has already been initialized by +device_initialize(), but the failure path returns the error without +dropping the device reference for the current platform device: + + mod_init() + -> platform_device_register(&pcmtst_pdev) + -> device_initialize(&pcmtst_pdev.dev) + -> setup_pdev_dma_masks(&pcmtst_pdev) + -> platform_device_add(&pcmtst_pdev) + +This leads to a reference leak when platform_device_register() fails. +Fix this by calling platform_device_put() before returning the error. + +The issue was identified by a static analysis tool I developed and +confirmed by manual review. + +Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Link: https://patch.msgid.link/20260415193138.3861297-1-lgs201920130244@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/drivers/pcmtest.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/drivers/pcmtest.c ++++ b/sound/drivers/pcmtest.c +@@ -756,8 +756,10 @@ static int __init mod_init(void) + if (err) + return err; + err = platform_device_register(&pcmtst_pdev); +- if (err) ++ if (err) { ++ platform_device_put(&pcmtst_pdev); + return err; ++ } + err = platform_driver_register(&pcmtst_pdrv); + if (err) + platform_device_unregister(&pcmtst_pdev); diff --git a/queue-7.0/alsa-pcmtest-fix-resource-leaks-in-module-init-error-paths.patch b/queue-7.0/alsa-pcmtest-fix-resource-leaks-in-module-init-error-paths.patch new file mode 100644 index 0000000000..3f5b0700f5 --- /dev/null +++ b/queue-7.0/alsa-pcmtest-fix-resource-leaks-in-module-init-error-paths.patch @@ -0,0 +1,65 @@ +From d5d5f80416a3a749906c04d56575e2290792654b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 21 Apr 2026 10:03:06 -0300 +Subject: ALSA: pcmtest: Fix resource leaks in module init error paths +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit d5d5f80416a3a749906c04d56575e2290792654b upstream. + +pcmtest allocates its pattern buffers and creates its debugfs tree +before registering the platform device and driver, but mod_init() +does not release those resources when a later init step fails. + +As a result, a debugfs directory creation failure leaks the pattern +buffers, while platform_device_register() and +platform_driver_register() failures leave both the pattern buffers +and the debugfs tree behind. The recent fix for failed device +registration only dropped the embedded device reference. + +Add the missing cleanup for the debugfs tree and pattern buffers in +the remaining module init error paths. + +Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260421-alsa-pcmtest-init-unwind-v1-1-03fe0c423dbb@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/drivers/pcmtest.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/sound/drivers/pcmtest.c ++++ b/sound/drivers/pcmtest.c +@@ -754,15 +754,24 @@ static int __init mod_init(void) + + err = init_debug_files(buf_allocated); + if (err) +- return err; ++ goto err_free_patterns; + err = platform_device_register(&pcmtst_pdev); + if (err) { + platform_device_put(&pcmtst_pdev); +- return err; ++ goto err_clear_debug; + } + err = platform_driver_register(&pcmtst_pdrv); +- if (err) ++ if (err) { + platform_device_unregister(&pcmtst_pdev); ++ goto err_clear_debug; ++ } ++ ++ return 0; ++ ++err_clear_debug: ++ clear_debug_files(); ++err_free_patterns: ++ free_pattern_buffers(); + return err; + } + diff --git a/queue-7.0/iio-adc-ad7768-1-fix-one-shot-mode-data-acquisition.patch b/queue-7.0/iio-adc-ad7768-1-fix-one-shot-mode-data-acquisition.patch new file mode 100644 index 0000000000..7752639e4c --- /dev/null +++ b/queue-7.0/iio-adc-ad7768-1-fix-one-shot-mode-data-acquisition.patch @@ -0,0 +1,51 @@ +From 8be19e233744961db6069da9c9ab63eb085a0447 Mon Sep 17 00:00:00 2001 +From: Jonathan Santos +Date: Mon, 23 Feb 2026 08:59:26 -0300 +Subject: iio: adc: ad7768-1: fix one-shot mode data acquisition + +From: Jonathan Santos + +commit 8be19e233744961db6069da9c9ab63eb085a0447 upstream. + +According to the datasheet, one-shot mode requires a SYNC_IN pulse to +trigger a new sample conversion. In the current implementation, No sync +pulse was sent after switching to one-shot mode and reinit_completion() +was called before mode switching, creating a race condition where spurious +interrupts during mode change could trigger completion prematurely. + +Fix by sending a sync pulse after configuring one-shot mode and +reinit_completion() to ensure it only waits for the actual conversion +completion. + +Fixes: a5f8c7da3dbe ("iio: adc: Add AD7768-1 ADC basic support") +Signed-off-by: Jonathan Santos +Reviewed-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7768-1.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/ad7768-1.c ++++ b/drivers/iio/adc/ad7768-1.c +@@ -463,12 +463,17 @@ static int ad7768_scan_direct(struct iio + struct ad7768_state *st = iio_priv(indio_dev); + int readval, ret; + +- reinit_completion(&st->completion); +- + ret = ad7768_set_mode(st, AD7768_ONE_SHOT); + if (ret < 0) + return ret; + ++ reinit_completion(&st->completion); ++ ++ /* One-shot mode requires a SYNC pulse to generate a new sample */ ++ ret = ad7768_send_sync_pulse(st); ++ if (ret) ++ return ret; ++ + ret = wait_for_completion_timeout(&st->completion, + msecs_to_jiffies(1000)); + if (!ret) diff --git a/queue-7.0/iio-adc-ad7768-1-remove-switch-to-one-shot-mode.patch b/queue-7.0/iio-adc-ad7768-1-remove-switch-to-one-shot-mode.patch new file mode 100644 index 0000000000..e0fc1c8d7d --- /dev/null +++ b/queue-7.0/iio-adc-ad7768-1-remove-switch-to-one-shot-mode.patch @@ -0,0 +1,70 @@ +From 81fdc3127d013a552465c3bf9829afbed5184406 Mon Sep 17 00:00:00 2001 +From: Jonathan Santos +Date: Mon, 23 Feb 2026 08:59:35 -0300 +Subject: iio: adc: ad7768-1: remove switch to one-shot mode + +From: Jonathan Santos + +commit 81fdc3127d013a552465c3bf9829afbed5184406 upstream. + +wideband low ripple FIR Filter is not available in one-shot mode. In +order to make direct reads work for all filter options, remove the +switch for one-shot mode and guarantee device is always in continuous +conversion mode. + +Fixes: fb1d3b24ebf5 ("iio: adc: ad7768-1: add filter type and oversampling ratio attributes") +Signed-off-by: Jonathan Santos +Reviewed-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7768-1.c | 21 ++++----------------- + 1 file changed, 4 insertions(+), 17 deletions(-) + +--- a/drivers/iio/adc/ad7768-1.c ++++ b/drivers/iio/adc/ad7768-1.c +@@ -463,17 +463,8 @@ static int ad7768_scan_direct(struct iio + struct ad7768_state *st = iio_priv(indio_dev); + int readval, ret; + +- ret = ad7768_set_mode(st, AD7768_ONE_SHOT); +- if (ret < 0) +- return ret; +- + reinit_completion(&st->completion); + +- /* One-shot mode requires a SYNC pulse to generate a new sample */ +- ret = ad7768_send_sync_pulse(st); +- if (ret) +- return ret; +- + ret = wait_for_completion_timeout(&st->completion, + msecs_to_jiffies(1000)); + if (!ret) +@@ -492,14 +483,6 @@ static int ad7768_scan_direct(struct iio + if (st->oversampling_ratio == 8) + readval >>= 8; + +- /* +- * Any SPI configuration of the AD7768-1 can only be +- * performed in continuous conversion mode. +- */ +- ret = ad7768_set_mode(st, AD7768_CONTINUOUS); +- if (ret < 0) +- return ret; +- + return readval; + } + +@@ -1257,6 +1240,10 @@ static int ad7768_setup(struct iio_dev * + return ret; + } + ++ ret = ad7768_set_mode(st, AD7768_CONTINUOUS); ++ if (ret) ++ return ret; ++ + /* For backwards compatibility, try the adi,sync-in-gpios property */ + st->gpio_sync_in = devm_gpiod_get_optional(&st->spi->dev, "adi,sync-in", + GPIOD_OUT_LOW); diff --git a/queue-7.0/parisc-led-fix-reference-leak-on-failed-device-registration.patch b/queue-7.0/parisc-led-fix-reference-leak-on-failed-device-registration.patch deleted file mode 100644 index dcbdf3039c..0000000000 --- a/queue-7.0/parisc-led-fix-reference-leak-on-failed-device-registration.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 707610bcccbd0327530938e33f3f33211a640a4e Mon Sep 17 00:00:00 2001 -From: Guangshuo Li -Date: Thu, 16 Apr 2026 01:05:15 +0800 -Subject: parisc: led: fix reference leak on failed device registration - -From: Guangshuo Li - -commit 707610bcccbd0327530938e33f3f33211a640a4e upstream. - -When platform_device_register() fails in startup_leds(), the embedded -struct device in platform_leds has already been initialized by -device_initialize(), but the failure path only reports the error and -does not drop the device reference for the current platform device: - - startup_leds() - -> platform_device_register(&platform_leds) - -> device_initialize(&platform_leds.dev) - -> setup_pdev_dma_masks(&platform_leds) - -> platform_device_add(&platform_leds) - -This leads to a reference leak when platform_device_register() fails. -Fix this by calling platform_device_put() after reporting the error. - -The issue was identified by a static analysis tool I developed and -confirmed by manual review. - -Fixes: 789e527adfc33 ("parisc: led: Rewrite LED/LCD driver to utilizize Linux LED subsystem") -Cc: stable@vger.kernel.org -Signed-off-by: Guangshuo Li -Signed-off-by: Helge Deller -Signed-off-by: Greg Kroah-Hartman ---- - drivers/parisc/led.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - ---- a/drivers/parisc/led.c -+++ b/drivers/parisc/led.c -@@ -543,8 +543,10 @@ static void __init register_led_regions( - - static int __init startup_leds(void) - { -- if (platform_device_register(&platform_leds)) -- printk(KERN_INFO "LED: failed to register LEDs\n"); -+ if (platform_device_register(&platform_leds)) { -+ pr_info("LED: failed to register LEDs\n"); -+ platform_device_put(&platform_leds); -+ } - register_led_regions(); - return 0; - } diff --git a/queue-7.0/series b/queue-7.0/series index 008f9305af..38a88ea668 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -87,7 +87,6 @@ nvme-pci-add-nvme_quirk_disable_write_zeroes-for-kingston-om3sgp4.patch nvme-respect-nvme_quirk_disable_write_zeroes-when-wzsl-is-set.patch parisc-_llseek-syscall-is-only-available-for-32-bit-userspace.patch parisc-drop-ip_fast_csum-inline-assembly-implementation.patch -parisc-led-fix-reference-leak-on-failed-device-registration.patch pci-cadence-use-cdns_pcie_read_sz-for-byte-or-word-read-access.patch pci-imx6-fix-reference-clock-source-selection-for-i.mx95.patch perf-annotate-use-jump__delete-when-freeing-loongarch-jumps.patch @@ -115,3 +114,12 @@ io_uring-poll-fix-signed-comparison-in-io_poll_get_ownership.patch io_uring-poll-ensure-epoll_oneshot-is-propagated-for-epoll_uring_wake.patch module.lds-codetag-force-0-sh_addr-for-sections.patch module.lds.s-fix-modules-on-32-bit-parisc-architecture.patch +alsa-core-fix-potential-data-race-at-fasync-handling.patch +alsa-caiaq-fix-control_put-result-and-cache-rollback.patch +alsa-caiaq-handle-probe-errors-properly.patch +alsa-6fire-fix-input-volume-change-detection.patch +alsa-hda-realtek-add-mute-led-support-for-hp-victus-15-fa2xxx.patch +alsa-pcmtest-fix-reference-leak-on-failed-device-registration.patch +alsa-pcmtest-fix-resource-leaks-in-module-init-error-paths.patch +iio-adc-ad7768-1-fix-one-shot-mode-data-acquisition.patch +iio-adc-ad7768-1-remove-switch-to-one-shot-mode.patch