5.10-stable patches

added patches:
	asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch
	asoc-tegra-fix-master-volume-control.patch
	netlink-add-nla-be16-32-types-to-minlen-array.patch
	xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch

diff --git a/queue-5.10/asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch b/queue-5.10/asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch
new file mode 100644 (file)
index 0000000..99fb179
--- /dev/null
+++ b/queue-5.10/asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch
@@ -0,0 +1,34 @@
+From 640eac4c849d6390f272862ba8db14f28d423670 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Tue, 8 Jun 2021 09:11:50 +0900
+Subject: ASoC: soc-core: don't use discriminatory terms on snd_soc_runtime_get_dai_fmt()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit 640eac4c849d6390f272862ba8db14f28d423670 upstream.
+
+snd_soc_runtime_get_dai_fmt() is using discriminatory terms.
+This patch fixup it.
+
+Fixes: ba9e82a1c891 ("ASoC: soc-core: add snd_soc_runtime_get_dai_fmt()")
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/874ke9dxkp.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-core.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1209,8 +1209,8 @@ found:
+               mask |= SND_SOC_DAIFMT_CLOCK_MASK;
+       if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_INV_MASK))
+               mask |= SND_SOC_DAIFMT_INV_MASK;
+-      if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_MASTER_MASK))
+-              mask |= SND_SOC_DAIFMT_MASTER_MASK;
++      if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK))
++              mask |= SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK;
+ 
+       dai_link->dai_fmt |= (dai_fmt & mask);
+ }

diff --git a/queue-5.10/asoc-tegra-fix-master-volume-control.patch b/queue-5.10/asoc-tegra-fix-master-volume-control.patch
new file mode 100644 (file)
index 0000000..0e992b4
--- /dev/null
+++ b/queue-5.10/asoc-tegra-fix-master-volume-control.patch
@@ -0,0 +1,36 @@
+From f9fd804aa0a36f15a35ca070ec4c52650876cc29 Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Tue, 13 Jun 2023 10:34:53 +0100
+Subject: ASoC: tegra: Fix Master Volume Control
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+commit f9fd804aa0a36f15a35ca070ec4c52650876cc29 upstream.
+
+Commit 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations") corrected
+the PCM wait_time calculations and in doing so reduced the calculated
+wait_time. This exposed an issue with the Tegra Master Volume Control
+(MVC) device where the reduced wait_time caused the MVC to fail. For now
+fix this by setting the default wait_time for Tegra to be 500ms.
+
+Fixes: 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations")
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20230613093453.13927-1-jonathanh@nvidia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/tegra/tegra_pcm.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/tegra/tegra_pcm.c
++++ b/sound/soc/tegra/tegra_pcm.c
+@@ -111,6 +111,9 @@ int tegra_pcm_open(struct snd_soc_compon
+               return ret;
+       }
+ 
++      /* Set wait time to 500ms by default */
++      substream->wait_time = 500;
++
+       return 0;
+ }
+ EXPORT_SYMBOL_GPL(tegra_pcm_open);

diff --git a/queue-5.10/netlink-add-nla-be16-32-types-to-minlen-array.patch b/queue-5.10/netlink-add-nla-be16-32-types-to-minlen-array.patch
new file mode 100644 (file)
index 0000000..789af66
--- /dev/null
+++ b/queue-5.10/netlink-add-nla-be16-32-types-to-minlen-array.patch
@@ -0,0 +1,60 @@
+From 9a0d18853c280f6a0ee99f91619f2442a17a323a Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 21 Feb 2024 18:27:33 +0100
+Subject: netlink: add nla be16/32 types to minlen array
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 9a0d18853c280f6a0ee99f91619f2442a17a323a upstream.
+
+BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline]
+BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline]
+BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline]
+BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631
+ nla_validate_range_unsigned lib/nlattr.c:222 [inline]
+ nla_validate_int_range lib/nlattr.c:336 [inline]
+ validate_nla lib/nlattr.c:575 [inline]
+...
+
+The message in question matches this policy:
+
+ [NFTA_TARGET_REV]       = NLA_POLICY_MAX(NLA_BE32, 255),
+
+but because NLA_BE32 size in minlen array is 0, the validation
+code will read past the malformed (too small) attribute.
+
+Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing:
+those likely should be added too.
+
+Reported-by: syzbot+3f497b07aa3baf2fb4d0@syzkaller.appspotmail.com
+Reported-by: xingwei lee <xrivendell7@gmail.com>
+Closes: https://lore.kernel.org/all/CABOYnLzFYHSnvTyS6zGa-udNX55+izqkOt2sB9WDqUcEGW6n8w@mail.gmail.com/raw
+Fixes: ecaf75ffd5f5 ("netlink: introduce bigendian integer types")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Link: https://lore.kernel.org/r/20240221172740.5092-1-fw@strlen.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/nlattr.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/lib/nlattr.c
++++ b/lib/nlattr.c
+@@ -30,6 +30,8 @@ static const u8 nla_attr_len[NLA_TYPE_MA
+       [NLA_S16]       = sizeof(s16),
+       [NLA_S32]       = sizeof(s32),
+       [NLA_S64]       = sizeof(s64),
++      [NLA_BE16]      = sizeof(__be16),
++      [NLA_BE32]      = sizeof(__be32),
+ };
+ 
+ static const u8 nla_attr_minlen[NLA_TYPE_MAX+1] = {
+@@ -43,6 +45,8 @@ static const u8 nla_attr_minlen[NLA_TYPE
+       [NLA_S16]       = sizeof(s16),
+       [NLA_S32]       = sizeof(s32),
+       [NLA_S64]       = sizeof(s64),
++      [NLA_BE16]      = sizeof(__be16),
++      [NLA_BE32]      = sizeof(__be32),
+ };
+ 
+ /*

diff --git a/queue-5.10/series b/queue-5.10/series
index fd04ad3d8267cd82f4e8f8f708a529dc4569aabd..ef32c85e161527aa588a9d71dfd13a3757bd31a2 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -454,3 +454,7 @@ mmc-vub300-fix-null-deref-on-disconnect.patch
 net-qualcomm-qca_uart-report-the-consumed-byte-on-rx-skb-allocation-failure.patch
 net-stmmac-fix-integer-underflow-in-chain-mode.patch
 rxrpc-fix-key-keyring-checks-in-setsockopt-rxrpc_security_key-keyring.patch
+xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch
+asoc-soc-core-don-t-use-discriminatory-terms-on-snd_soc_runtime_get_dai_fmt.patch
+asoc-tegra-fix-master-volume-control.patch
+netlink-add-nla-be16-32-types-to-minlen-array.patch

diff --git a/queue-5.10/xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch b/queue-5.10/xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch
new file mode 100644 (file)
index 0000000..d11e968
--- /dev/null
+++ b/queue-5.10/xen-privcmd-unregister-xenstore-notifier-on-module-exit.patch
@@ -0,0 +1,42 @@
+From cd7e1fef5a1ca1c4fcd232211962ac2395601636 Mon Sep 17 00:00:00 2001
+From: GuoHan Zhao <zhaoguohan@kylinos.cn>
+Date: Wed, 25 Mar 2026 20:02:46 +0800
+Subject: xen/privcmd: unregister xenstore notifier on module exit
+
+From: GuoHan Zhao <zhaoguohan@kylinos.cn>
+
+commit cd7e1fef5a1ca1c4fcd232211962ac2395601636 upstream.
+
+Commit 453b8fb68f36 ("xen/privcmd: restrict usage in
+unprivileged domU") added a xenstore notifier to defer setting the
+restriction target until Xenstore is ready.
+
+XEN_PRIVCMD can be built as a module, but privcmd_exit() leaves that
+notifier behind. Balance the notifier lifecycle by unregistering it on
+module exit.
+
+This is harmless even if xenstore was already ready at registration
+time and the notifier was never queued on the chain.
+
+Fixes: 453b8fb68f3641fe ("xen/privcmd: restrict usage in unprivileged domU")
+Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20260325120246.252899-1-zhaoguohan@kylinos.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/privcmd.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/xen/privcmd.c
++++ b/drivers/xen/privcmd.c
+@@ -1069,6 +1069,9 @@ static int __init privcmd_init(void)
+ 
+ static void __exit privcmd_exit(void)
+ {
++      if (!xen_initial_domain())
++              unregister_xenstore_notifier(&xenstore_notifier);
++
+       misc_deregister(&privcmd_dev);
+       misc_deregister(&xen_privcmdbuf_dev);
+ }