From: Greg Kroah-Hartman Date: Fri, 1 May 2026 10:46:25 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.12.86~66 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ae300af42df95d80b28cc7fdb7b290249026bcc6;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: alsa-aoa-i2sbus-clear-stale-prepared-state.patch alsa-aoa-i2sbus-fix-of-node-lifetime-handling.patch alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch alsa-ctxfi-add-fallback-to-default-rsr-for-s-pdif.patch alsa-seq_oss-return-full-count-for-successful-seq_fullsize-writes.patch --- diff --git a/queue-6.18/alsa-aoa-i2sbus-clear-stale-prepared-state.patch b/queue-6.18/alsa-aoa-i2sbus-clear-stale-prepared-state.patch new file mode 100644 index 0000000000..6078578d26 --- /dev/null +++ b/queue-6.18/alsa-aoa-i2sbus-clear-stale-prepared-state.patch @@ -0,0 +1,164 @@ +From 5ed060d5491597490fb53ec69da3edc4b1e8c165 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 31 Mar 2026 18:14:04 -0300 +Subject: ALSA: aoa: i2sbus: clear stale prepared state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 5ed060d5491597490fb53ec69da3edc4b1e8c165 upstream. + +The i2sbus PCM code uses pi->active to constrain the sibling stream to +an already prepared duplex format and rate in i2sbus_pcm_open(). + +That state is set from i2sbus_pcm_prepare(), but the current code only +clears it on close. As a result, the sibling stream can inherit stale +constraints after the prepared state has been torn down. + +Clear pi->active when hw_params() or hw_free() tears down the prepared +state, and set it again only after prepare succeeds. + +Replace the stale FIXME in the duplex constraint comment with a description +of the current driver behavior: i2sbus still programs a single shared +transport configuration for both directions, so mixed formats are not +supported in duplex mode. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202604010125.AvkWBYKI-lkp@intel.com/ +Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260331-aoa-i2sbus-clear-stale-active-v2-1-3764ae2889a1@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/aoa/soundbus/i2sbus/pcm.c | 55 ++++++++++++++++++++++++++++++++-------- + 1 file changed, 44 insertions(+), 11 deletions(-) + +--- a/sound/aoa/soundbus/i2sbus/pcm.c ++++ b/sound/aoa/soundbus/i2sbus/pcm.c +@@ -165,17 +165,16 @@ static int i2sbus_pcm_open(struct i2sbus + * currently in use (if any). */ + hw->rate_min = 5512; + hw->rate_max = 192000; +- /* if the other stream is active, then we can only +- * support what it is currently using. +- * FIXME: I lied. This comment is wrong. We can support +- * anything that works with the same serial format, ie. +- * when recording 24 bit sound we can well play 16 bit +- * sound at the same time iff using the same transfer mode. ++ /* If the other stream is already prepared, keep this stream ++ * on the same duplex format and rate. ++ * ++ * i2sbus_pcm_prepare() still programs one shared transport ++ * configuration for both directions, so mixed duplex formats ++ * are not supported here. + */ + if (other->active) { +- /* FIXME: is this guaranteed by the alsa api? */ + hw->formats &= pcm_format_to_bits(i2sdev->format); +- /* see above, restrict rates to the one we already have */ ++ /* Restrict rates to the one already in use. */ + hw->rate_min = i2sdev->rate; + hw->rate_max = i2sdev->rate; + } +@@ -283,6 +282,23 @@ void i2sbus_wait_for_stop_both(struct i2 + } + #endif + ++static void i2sbus_pcm_clear_active(struct i2sbus_dev *i2sdev, int in) ++{ ++ struct pcm_info *pi; ++ ++ guard(mutex)(&i2sdev->lock); ++ ++ get_pcm_info(i2sdev, in, &pi, NULL); ++ pi->active = 0; ++} ++ ++static inline int i2sbus_hw_params(struct snd_pcm_substream *substream, ++ struct snd_pcm_hw_params *params, int in) ++{ ++ i2sbus_pcm_clear_active(snd_pcm_substream_chip(substream), in); ++ return 0; ++} ++ + static inline int i2sbus_hw_free(struct snd_pcm_substream *substream, int in) + { + struct i2sbus_dev *i2sdev = snd_pcm_substream_chip(substream); +@@ -291,14 +307,27 @@ static inline int i2sbus_hw_free(struct + get_pcm_info(i2sdev, in, &pi, NULL); + if (pi->dbdma_ring.stopping) + i2sbus_wait_for_stop(i2sdev, pi); ++ i2sbus_pcm_clear_active(i2sdev, in); + return 0; + } + ++static int i2sbus_playback_hw_params(struct snd_pcm_substream *substream, ++ struct snd_pcm_hw_params *params) ++{ ++ return i2sbus_hw_params(substream, params, 0); ++} ++ + static int i2sbus_playback_hw_free(struct snd_pcm_substream *substream) + { + return i2sbus_hw_free(substream, 0); + } + ++static int i2sbus_record_hw_params(struct snd_pcm_substream *substream, ++ struct snd_pcm_hw_params *params) ++{ ++ return i2sbus_hw_params(substream, params, 1); ++} ++ + static int i2sbus_record_hw_free(struct snd_pcm_substream *substream) + { + return i2sbus_hw_free(substream, 1); +@@ -335,7 +364,6 @@ static int i2sbus_pcm_prepare(struct i2s + return -EINVAL; + + runtime = pi->substream->runtime; +- pi->active = 1; + if (other->active && + ((i2sdev->format != runtime->format) + || (i2sdev->rate != runtime->rate))) +@@ -450,9 +478,11 @@ static int i2sbus_pcm_prepare(struct i2s + + /* early exit if already programmed correctly */ + /* not locking these is fine since we touch them only in this function */ +- if (in_le32(&i2sdev->intfregs->serial_format) == sfr +- && in_le32(&i2sdev->intfregs->data_word_sizes) == dws) ++ if (in_le32(&i2sdev->intfregs->serial_format) == sfr && ++ in_le32(&i2sdev->intfregs->data_word_sizes) == dws) { ++ pi->active = 1; + return 0; ++ } + + /* let's notify the codecs about clocks going away. + * For now we only do mastering on the i2s cell... */ +@@ -490,6 +520,7 @@ static int i2sbus_pcm_prepare(struct i2s + if (cii->codec->switch_clock) + cii->codec->switch_clock(cii, CLOCK_SWITCH_SLAVE); + ++ pi->active = 1; + return 0; + } + +@@ -734,6 +765,7 @@ static snd_pcm_uframes_t i2sbus_playback + static const struct snd_pcm_ops i2sbus_playback_ops = { + .open = i2sbus_playback_open, + .close = i2sbus_playback_close, ++ .hw_params = i2sbus_playback_hw_params, + .hw_free = i2sbus_playback_hw_free, + .prepare = i2sbus_playback_prepare, + .trigger = i2sbus_playback_trigger, +@@ -802,6 +834,7 @@ static snd_pcm_uframes_t i2sbus_record_p + static const struct snd_pcm_ops i2sbus_record_ops = { + .open = i2sbus_record_open, + .close = i2sbus_record_close, ++ .hw_params = i2sbus_record_hw_params, + .hw_free = i2sbus_record_hw_free, + .prepare = i2sbus_record_prepare, + .trigger = i2sbus_record_trigger, diff --git a/queue-6.18/alsa-aoa-i2sbus-fix-of-node-lifetime-handling.patch b/queue-6.18/alsa-aoa-i2sbus-fix-of-node-lifetime-handling.patch new file mode 100644 index 0000000000..691c98e9bf --- /dev/null +++ b/queue-6.18/alsa-aoa-i2sbus-fix-of-node-lifetime-handling.patch @@ -0,0 +1,86 @@ +From 4ec93f070eda6b765b62efcaed9241c3b3b0b6ad Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Mon, 30 Mar 2026 01:00:34 -0300 +Subject: ALSA: aoa: i2sbus: fix OF node lifetime handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 4ec93f070eda6b765b62efcaed9241c3b3b0b6ad upstream. + +i2sbus_add_dev() keeps the matched "sound" child pointer after +for_each_child_of_node() has dropped the iterator reference. Take an +extra reference before saving that node and drop it after the +layout-id/device-id lookup is complete. + +The function also stores np in dev->sound.ofdev.dev.of_node without +taking a reference for the embedded soundbus device. Since i2sbus +overrides the embedded platform device release callback, balance that +reference explicitly in the local error path and in i2sbus_release_dev(). + +Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260330-aoa-i2sbus-ofnode-lifetime-v1-1-51c309f4ff06@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/aoa/soundbus/i2sbus/core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/sound/aoa/soundbus/i2sbus/core.c ++++ b/sound/aoa/soundbus/i2sbus/core.c +@@ -84,6 +84,7 @@ static void i2sbus_release_dev(struct de + for (i = aoa_resource_i2smmio; i <= aoa_resource_rxdbdma; i++) + free_irq(i2sdev->interrupts[i], i2sdev); + i2sbus_control_remove_dev(i2sdev->control, i2sdev); ++ of_node_put(i2sdev->sound.ofdev.dev.of_node); + mutex_destroy(&i2sdev->lock); + kfree(i2sdev); + } +@@ -147,7 +148,6 @@ static int i2sbus_get_and_fixup_rsrc(str + } + + /* Returns 1 if added, 0 for otherwise; don't return a negative value! */ +-/* FIXME: look at device node refcounting */ + static int i2sbus_add_dev(struct macio_dev *macio, + struct i2sbus_control *control, + struct device_node *np) +@@ -178,8 +178,9 @@ static int i2sbus_add_dev(struct macio_d + i = 0; + for_each_child_of_node(np, child) { + if (of_node_name_eq(child, "sound")) { ++ of_node_put(sound); + i++; +- sound = child; ++ sound = of_node_get(child); + } + } + if (i == 1) { +@@ -205,6 +206,7 @@ static int i2sbus_add_dev(struct macio_d + } + } + } ++ of_node_put(sound); + /* for the time being, until we can handle non-layout-id + * things in some fabric, refuse to attach if there is no + * layout-id property or we haven't been forced to attach. +@@ -219,7 +221,7 @@ static int i2sbus_add_dev(struct macio_d + mutex_init(&dev->lock); + spin_lock_init(&dev->low_lock); + dev->sound.ofdev.archdata.dma_mask = macio->ofdev.archdata.dma_mask; +- dev->sound.ofdev.dev.of_node = np; ++ dev->sound.ofdev.dev.of_node = of_node_get(np); + dev->sound.ofdev.dev.dma_mask = &dev->sound.ofdev.archdata.dma_mask; + dev->sound.ofdev.dev.parent = &macio->ofdev.dev; + dev->sound.ofdev.dev.release = i2sbus_release_dev; +@@ -327,6 +329,7 @@ static int i2sbus_add_dev(struct macio_d + for (i=0;i<3;i++) + release_and_free_resource(dev->allocated_resource[i]); + mutex_destroy(&dev->lock); ++ of_node_put(dev->sound.ofdev.dev.of_node); + kfree(dev); + return 0; + } diff --git a/queue-6.18/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch b/queue-6.18/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch new file mode 100644 index 0000000000..6bd4892749 --- /dev/null +++ b/queue-6.18/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch @@ -0,0 +1,79 @@ +From fd7df93013c5118812e63a52635dc6c3a805a1de Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Tue, 10 Mar 2026 11:29:20 +0100 +Subject: ALSA: aoa: Skip devices with no codecs in i2sbus_resume() + +From: Thorsten Blum + +commit fd7df93013c5118812e63a52635dc6c3a805a1de upstream. + +In i2sbus_resume(), skip devices with an empty codec list, which avoids +using an uninitialized 'sysclock_factor' in the 32-bit format path in +i2sbus_pcm_prepare(). + +In i2sbus_pcm_prepare(), replace two list_for_each_entry() loops with a +single list_first_entry() now that the codec list is guaranteed to be +non-empty by all callers. + +Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") +Cc: stable@vger.kernel.org +Signed-off-by: Thorsten Blum +Link: https://patch.msgid.link/20260310102921.210109-3-thorsten.blum@linux.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/aoa/soundbus/i2sbus/core.c | 3 +++ + sound/aoa/soundbus/i2sbus/pcm.c | 16 +++++----------- + 2 files changed, 8 insertions(+), 11 deletions(-) + +--- a/sound/aoa/soundbus/i2sbus/core.c ++++ b/sound/aoa/soundbus/i2sbus/core.c +@@ -408,6 +408,9 @@ static int i2sbus_resume(struct macio_de + int err, ret = 0; + + list_for_each_entry(i2sdev, &control->list, item) { ++ if (list_empty(&i2sdev->sound.codec_list)) ++ continue; ++ + /* reset i2s bus format etc. */ + i2sbus_pcm_prepare_both(i2sdev); + +--- a/sound/aoa/soundbus/i2sbus/pcm.c ++++ b/sound/aoa/soundbus/i2sbus/pcm.c +@@ -411,6 +411,9 @@ static int i2sbus_pcm_prepare(struct i2s + /* set stop command */ + command->command = cpu_to_le16(DBDMA_STOP); + ++ cii = list_first_entry(&i2sdev->sound.codec_list, ++ struct codec_info_item, list); ++ + /* ok, let's set the serial format and stuff */ + switch (runtime->format) { + /* 16 bit formats */ +@@ -418,13 +421,7 @@ static int i2sbus_pcm_prepare(struct i2s + case SNDRV_PCM_FORMAT_U16_BE: + /* FIXME: if we add different bus factors we need to + * do more here!! */ +- bi.bus_factor = 0; +- list_for_each_entry(cii, &i2sdev->sound.codec_list, list) { +- bi.bus_factor = cii->codec->bus_factor; +- break; +- } +- if (!bi.bus_factor) +- return -ENODEV; ++ bi.bus_factor = cii->codec->bus_factor; + input_16bit = 1; + break; + case SNDRV_PCM_FORMAT_S32_BE: +@@ -438,10 +435,7 @@ static int i2sbus_pcm_prepare(struct i2s + return -EINVAL; + } + /* we assume all sysclocks are the same! */ +- list_for_each_entry(cii, &i2sdev->sound.codec_list, list) { +- bi.sysclock_factor = cii->codec->sysclock_factor; +- break; +- } ++ bi.sysclock_factor = cii->codec->sysclock_factor; + + if (clock_and_divisors(bi.sysclock_factor, + bi.bus_factor, diff --git a/queue-6.18/alsa-ctxfi-add-fallback-to-default-rsr-for-s-pdif.patch b/queue-6.18/alsa-ctxfi-add-fallback-to-default-rsr-for-s-pdif.patch new file mode 100644 index 0000000000..8a1bac2fdd --- /dev/null +++ b/queue-6.18/alsa-ctxfi-add-fallback-to-default-rsr-for-s-pdif.patch @@ -0,0 +1,44 @@ +From 7d61662197ecdc458e33e475b6ada7f6da61d364 Mon Sep 17 00:00:00 2001 +From: Harin Lee +Date: Mon, 6 Apr 2026 16:49:13 +0900 +Subject: ALSA: ctxfi: Add fallback to default RSR for S/PDIF + +From: Harin Lee + +commit 7d61662197ecdc458e33e475b6ada7f6da61d364 upstream. + +spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR +for the MSR calculation loop. However, pll_rate is only updated in +atc_pll_init() and not in hw_pll_init(), so it remains 0 after the +card init. + +When spdif_passthru_playback_setup() skips atc_pll_init() for +32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin +indefinitely. + +Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects +the hardware state, since hw_card_init() already configures the PLL +to the default RSR. + +Fixes: 8cc72361481f ("ALSA: SB X-Fi driver merge") +Cc: stable@vger.kernel.org +Signed-off-by: Harin Lee +Link: https://patch.msgid.link/20260406074913.217374-1-me@harin.net +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/ctxfi/ctatc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/ctxfi/ctatc.c ++++ b/sound/pci/ctxfi/ctatc.c +@@ -788,7 +788,8 @@ static int spdif_passthru_playback_get_r + struct src *src; + int err; + int n_amixer = apcm->substream->runtime->channels, i; +- unsigned int pitch, rsr = atc->pll_rate; ++ unsigned int pitch; ++ unsigned int rsr = atc->pll_rate ? atc->pll_rate : atc->rsr; + + /* first release old resources */ + atc_pcm_release_resources(atc, apcm); diff --git a/queue-6.18/alsa-seq_oss-return-full-count-for-successful-seq_fullsize-writes.patch b/queue-6.18/alsa-seq_oss-return-full-count-for-successful-seq_fullsize-writes.patch new file mode 100644 index 0000000000..003ffed676 --- /dev/null +++ b/queue-6.18/alsa-seq_oss-return-full-count-for-successful-seq_fullsize-writes.patch @@ -0,0 +1,49 @@ +From bbc6c0dda54fc0ad8f8aed0b796c23e186e1a188 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 24 Mar 2026 16:59:41 -0300 +Subject: ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit bbc6c0dda54fc0ad8f8aed0b796c23e186e1a188 upstream. + +snd_seq_oss_write() currently returns the raw load_patch() callback +result for SEQ_FULLSIZE events. + +That callback is documented as returning 0 on success and -errno on +failure, but snd_seq_oss_write() is the file write path and should +report the number of user bytes consumed on success. Some in-tree +backends also return backend-specific positive values, which can still +be shorter than the original write size. + +Return the full byte count for successful SEQ_FULLSIZE writes. +Preserve negative errors and convert any nonnegative completion to the +original count. + +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260324-alsa-seq-oss-fullsize-write-return-v1-1-66d448510538@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/oss/seq_oss_rw.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/core/seq/oss/seq_oss_rw.c ++++ b/sound/core/seq/oss/seq_oss_rw.c +@@ -101,9 +101,9 @@ snd_seq_oss_write(struct seq_oss_devinfo + break; + } + fmt = (*(unsigned short *)rec.c) & 0xffff; +- /* FIXME the return value isn't correct */ +- return snd_seq_oss_synth_load_patch(dp, rec.s.dev, +- fmt, buf, 0, count); ++ err = snd_seq_oss_synth_load_patch(dp, rec.s.dev, ++ fmt, buf, 0, count); ++ return err < 0 ? err : count; + } + if (ev_is_long(&rec)) { + /* extended code */ diff --git a/queue-6.18/series b/queue-6.18/series index 77009bf6d3..3ac44cf98c 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -58,3 +58,8 @@ media-i2c-imx219-check-return-value-of-devm_gpiod_get_optional-in-imx219_probe.p net-qrtr-ns-fix-use-after-free-in-driver-remove.patch ext2-reject-inodes-with-zero-i_nlink-and-valid-mode-in-ext2_iget.patch mm-zsmalloc-copy-kmsan-metadata-in-zs_page_migrate.patch +alsa-aoa-i2sbus-clear-stale-prepared-state.patch +alsa-aoa-i2sbus-fix-of-node-lifetime-handling.patch +alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch +alsa-ctxfi-add-fallback-to-default-rsr-for-s-pdif.patch +alsa-seq_oss-return-full-count-for-successful-seq_fullsize-writes.patch