From ebfef55c0e10e023d208763002e8a6ddec7523e7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 9 Feb 2026 14:45:21 +0100 Subject: [PATCH] 6.18-stable patches added patches: alsa-hda-realtek-really-fix-headset-mic-for-tongfang-x6ar55xu.patch alsa-usb-audio-use-the-right-limit-for-pcm-oob-check.patch riscv-add-intermediate-cast-to-unsigned-long-in-__get_user_asm.patch --- ...ix-headset-mic-for-tongfang-x6ar55xu.patch | 45 +++++++++++++ ...se-the-right-limit-for-pcm-oob-check.patch | 38 +++++++++++ ...t-to-unsigned-long-in-__get_user_asm.patch | 65 +++++++++++++++++++ queue-6.18/series | 3 + 4 files changed, 151 insertions(+) create mode 100644 queue-6.18/alsa-hda-realtek-really-fix-headset-mic-for-tongfang-x6ar55xu.patch create mode 100644 queue-6.18/alsa-usb-audio-use-the-right-limit-for-pcm-oob-check.patch create mode 100644 queue-6.18/riscv-add-intermediate-cast-to-unsigned-long-in-__get_user_asm.patch diff --git a/queue-6.18/alsa-hda-realtek-really-fix-headset-mic-for-tongfang-x6ar55xu.patch b/queue-6.18/alsa-hda-realtek-really-fix-headset-mic-for-tongfang-x6ar55xu.patch new file mode 100644 index 0000000000..7b0e980907 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-really-fix-headset-mic-for-tongfang-x6ar55xu.patch @@ -0,0 +1,45 @@ +From 1aaedafb21f38cb872d44f7608b4828a1e14e795 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Fri, 23 Jan 2026 23:12:24 +0100 +Subject: ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. + +From: Werner Sembach + +commit 1aaedafb21f38cb872d44f7608b4828a1e14e795 upstream. + +Add a PCI quirk to enable microphone detection on the headphone jack of +TongFang X6AR55xU devices. + +The former quirk entry did not acomplish this and is removed. + +Fixes: b48fe9af1e60 ("ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU") +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260123221233.28273-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/codecs/realtek/alc269.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -7232,6 +7232,7 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x1d05, 0x1409, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1d05, 0x3031, "TongFang X6AR55xU", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), +@@ -7701,10 +7702,6 @@ static const struct snd_hda_pin_quirk al + {0x12, 0x90a60140}, + {0x19, 0x04a11030}, + {0x21, 0x04211020}), +- SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC, +- {0x17, 0x90170110}, +- {0x19, 0x03a11030}, +- {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC282_STANDARD_PINS, + {0x12, 0x90a609c0}, diff --git a/queue-6.18/alsa-usb-audio-use-the-right-limit-for-pcm-oob-check.patch b/queue-6.18/alsa-usb-audio-use-the-right-limit-for-pcm-oob-check.patch new file mode 100644 index 0000000000..7bccf04bca --- /dev/null +++ b/queue-6.18/alsa-usb-audio-use-the-right-limit-for-pcm-oob-check.patch @@ -0,0 +1,38 @@ +From 70b4db7d258118a7464f039112a74ddb49a95b06 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 21 Jan 2026 09:20:20 +0100 +Subject: ALSA: usb-audio: Use the right limit for PCM OOB check + +From: Takashi Iwai + +commit 70b4db7d258118a7464f039112a74ddb49a95b06 upstream. + +The recent fix commit for addressing the OOB access of PCM URB data +buffer caused a regression on Behringer UMC2020HD device, resulting in +choppy sound. The fix used ep->max_urb_frames for the upper limit +check, and this is no right value to be referred. + +Use the actual buffer size (ctx->buffer_size) as the upper limit +instead, which also avoids the regression on the device above. + +Fixes: ef5749ef8b30 ("ALSA: usb-audio: Prevent excessive number of frames") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=220997 +Link: https://patch.msgid.link/20260121082025.718748-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/pcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1553,7 +1553,8 @@ static int prepare_playback_urb(struct s + + for (i = 0; i < ctx->packets; i++) { + counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail); +- if (counts < 0 || frames + counts >= ep->max_urb_frames) ++ if (counts < 0 || ++ (frames + counts) * stride > ctx->buffer_size) + break; + /* set up descriptor */ + urb->iso_frame_desc[i].offset = frames * stride; diff --git a/queue-6.18/riscv-add-intermediate-cast-to-unsigned-long-in-__get_user_asm.patch b/queue-6.18/riscv-add-intermediate-cast-to-unsigned-long-in-__get_user_asm.patch new file mode 100644 index 0000000000..683be978d4 --- /dev/null +++ b/queue-6.18/riscv-add-intermediate-cast-to-unsigned-long-in-__get_user_asm.patch @@ -0,0 +1,65 @@ +From 841e47d56cef9b96fd2314220e3d0f1d92c719f4 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 21 Jan 2026 14:36:00 -0700 +Subject: riscv: Add intermediate cast to 'unsigned long' in __get_user_asm + +From: Nathan Chancellor + +commit 841e47d56cef9b96fd2314220e3d0f1d92c719f4 upstream. + +After commit bdce162f2e57 ("riscv: Use 64-bit variable for output in +__get_user_asm"), there is a warning when building for 32-bit RISC-V: + + In file included from include/linux/uaccess.h:13, + from include/linux/sched/task.h:13, + from include/linux/sched/signal.h:9, + from include/linux/rcuwait.h:6, + from include/linux/mm.h:36, + from include/linux/migrate.h:5, + from mm/migrate.c:16: + mm/migrate.c: In function 'do_pages_move': + arch/riscv/include/asm/uaccess.h:115:15: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + 115 | (x) = (__typeof__(x))__tmp; \ + | ^ + arch/riscv/include/asm/uaccess.h:198:17: note: in expansion of macro '__get_user_asm' + 198 | __get_user_asm("lb", (x), __gu_ptr, label); \ + | ^~~~~~~~~~~~~~ + arch/riscv/include/asm/uaccess.h:218:9: note: in expansion of macro '__get_user_nocheck' + 218 | __get_user_nocheck(x, ptr, __gu_failed); \ + | ^~~~~~~~~~~~~~~~~~ + arch/riscv/include/asm/uaccess.h:255:9: note: in expansion of macro '__get_user_error' + 255 | __get_user_error(__gu_val, __gu_ptr, __gu_err); \ + | ^~~~~~~~~~~~~~~~ + arch/riscv/include/asm/uaccess.h:285:17: note: in expansion of macro '__get_user' + 285 | __get_user((x), __p) : \ + | ^~~~~~~~~~ + mm/migrate.c:2358:29: note: in expansion of macro 'get_user' + 2358 | if (get_user(p, pages + i)) + | ^~~~~~~~ + +Add an intermediate cast to 'unsigned long', which is guaranteed to be the same +width as a pointer, before the cast to the type of the output variable to clear +up the warning. + +Fixes: bdce162f2e57 ("riscv: Use 64-bit variable for output in __get_user_asm") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202601210526.OT45dlOZ-lkp@intel.com/ +Signed-off-by: Nathan Chancellor +Link: https://patch.msgid.link/20260121-riscv-fix-int-to-pointer-cast-v1-1-b83eebe57c76@kernel.org +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/uaccess.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/include/asm/uaccess.h ++++ b/arch/riscv/include/asm/uaccess.h +@@ -112,7 +112,7 @@ do { \ + _ASM_EXTABLE_UACCESS_ERR(1b, %l2, %0) \ + : "=&r" (__tmp) \ + : "m" (*(ptr)) : : label); \ +- (x) = (__typeof__(x))__tmp; \ ++ (x) = (__typeof__(x))(unsigned long)__tmp; \ + } while (0) + #else /* !CONFIG_CC_HAS_ASM_GOTO_OUTPUT */ + #define __get_user_asm(insn, x, ptr, label) \ diff --git a/queue-6.18/series b/queue-6.18/series index 0fb7d3eded..0db225afae 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -170,3 +170,6 @@ spi-tegra210-quad-protect-curr_xfer-clearing-in-tegr.patch spi-tegra210-quad-protect-curr_xfer-check-in-irq-han.patch spi-tegra-fix-a-memory-leak-in-tegra_slink_probe.patch spi-tegra114-preserve-spi-mode-bits-in-def_command1_.patch +alsa-hda-realtek-really-fix-headset-mic-for-tongfang-x6ar55xu.patch +alsa-usb-audio-use-the-right-limit-for-pcm-oob-check.patch +riscv-add-intermediate-cast-to-unsigned-long-in-__get_user_asm.patch -- 2.47.3