From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 13:20:06 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=29a219585d461e5d9541e8e3a10d0be52a2d1535;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: alsa-doc-usb-audio-add-doc-for-quirk_flag_ifb_silence_on_empty.patch bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch --- diff --git a/queue-7.1/alsa-doc-usb-audio-add-doc-for-quirk_flag_ifb_silence_on_empty.patch b/queue-7.1/alsa-doc-usb-audio-add-doc-for-quirk_flag_ifb_silence_on_empty.patch new file mode 100644 index 0000000000..0f384e7e90 --- /dev/null +++ b/queue-7.1/alsa-doc-usb-audio-add-doc-for-quirk_flag_ifb_silence_on_empty.patch @@ -0,0 +1,36 @@ +From 06363f96e3d6b54ff7b5d2ce85cab95bd5e874b0 Mon Sep 17 00:00:00 2001 +From: Rong Zhang +Date: Wed, 27 May 2026 01:49:23 +0800 +Subject: ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY + +From: Rong Zhang + +commit 06363f96e3d6b54ff7b5d2ce85cab95bd5e874b0 upstream. + +QUIRK_FLAG_IFB_SILENCE_ON_EMPTY was introduced into usb-audio before +without appropriate documentation, so add it. + +Fixes: a23812004228 ("ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8") +Signed-off-by: Rong Zhang +Link: https://patch.msgid.link/20260527-uac-quirk-get-cur-vol-v1-1-e9362b712e5e@rong.moe +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/sound/alsa-configuration.rst | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/Documentation/sound/alsa-configuration.rst ++++ b/Documentation/sound/alsa-configuration.rst +@@ -2383,6 +2383,12 @@ quirk_flags + ``V(x) = k * x``; ``dB(x) = 20 * log10(x)``. Overrides bit 24 + * bit 28: ``mixer_capture_linear_vol`` + Similar to bit 27 but for capture streams. Overrides bit 25 ++ * bit 29: ``ifb_silence_on_empty`` ++ In implicit feedback mode, when an entire capture URB returns with ++ all iso_frame_desc[i].status != 0 (bytes==0), do not silently return ++ from snd_usb_handle_sync_urb. Instead fall through and enqueue a ++ packet_info containing only size-0 packets, so the OUT ring keeps ++ moving (emits silence). Needed by Behringer Flow 8 (1397:050c). + + This module supports multiple devices, autoprobe and hotplugging. + diff --git a/queue-7.1/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch b/queue-7.1/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch new file mode 100644 index 0000000000..e63981338e --- /dev/null +++ b/queue-7.1/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch @@ -0,0 +1,62 @@ +From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Fri, 12 Jun 2026 10:21:09 -0400 +Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev + +From: Luiz Augusto von Dentz + +commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream. + +b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding +conn ref") don't reset the chan->conn to NULL anymore making the bt# +netdev not be remove once the last l2cap_chan_del is removed. + +Instead of restoring the original behavior this remove the logic of +keeping the interface after the last channel is removed because it +never worked as intended and the l2cap_chan_del always detach its +l2cap_conn which results in always removing the channel anyway. + +Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/6lowpan.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -777,20 +777,10 @@ static void chan_close_cb(struct l2cap_c + struct lowpan_btle_dev *dev = NULL; + struct lowpan_peer *peer; + int err = -ENOENT; +- bool last = false, remove = true; ++ bool last = false; + + BT_DBG("chan %p conn %p", chan, chan->conn); + +- if (chan->conn && chan->conn->hcon) { +- if (!is_bt_6lowpan(chan->conn->hcon)) +- return; +- +- /* If conn is set, then the netdev is also there and we should +- * not remove it. +- */ +- remove = false; +- } +- + spin_lock(&devices_lock); + + list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { +@@ -817,10 +807,8 @@ static void chan_close_cb(struct l2cap_c + + ifdown(dev->netdev); + +- if (remove) { +- INIT_WORK(&entry->delete_netdev, delete_netdev); +- schedule_work(&entry->delete_netdev); +- } ++ INIT_WORK(&entry->delete_netdev, delete_netdev); ++ schedule_work(&entry->delete_netdev); + } else { + spin_unlock(&devices_lock); + } diff --git a/queue-7.1/series b/queue-7.1/series index 18c3689195..4b05c604d4 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -513,3 +513,6 @@ fuse-uring-avoid-use-after-free-in-fuse_uring_async_stop_queues.patch fuse-uring-avoid-queue-stopped-races-and-set-read-that-value-under-lock.patch fuse-uring-make-a-fuse_req-on-sqe-commit-only-findable-after-memcpy.patch fuse-uring-remove-request-less-entries-from-ent_w_req_queue-to-fix-null-deref.patch +alsa-doc-usb-audio-add-doc-for-quirk_flag_ifb_silence_on_empty.patch +timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch +bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch diff --git a/queue-7.1/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch b/queue-7.1/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch new file mode 100644 index 0000000000..d2147b3dd8 --- /dev/null +++ b/queue-7.1/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch @@ -0,0 +1,65 @@ +From 8fa30821180a9a19e78e9f4df1c0ba710252801e Mon Sep 17 00:00:00 2001 +From: Mikhail Gavrilov +Date: Tue, 16 Jun 2026 12:09:14 +0500 +Subject: timekeeping: Register default clocksource before taking tk_core.lock + +From: Mikhail Gavrilov + +commit 8fa30821180a9a19e78e9f4df1c0ba710252801e upstream. + +Commit f24df84cbe05 ("time/jiffies: Register jiffies clocksource before +usage") moved the jiffies clocksource registration into +clocksource_default_clock(), so that it is registered lazily on the first +call. __clocksource_register() acquires clocksource_mutex, but the first +caller is timekeeping_init(), which invokes clocksource_default_clock() +while holding tk_core.lock, a raw spinlock. + +Acquiring a sleeping mutex while holding a raw spinlock is invalid. + +The default clocksource only has to be registered before +tk_setup_internals() consumes its mult/shift/maxadj. Neither +clocksource_default_clock(), the ->enable() callback, nor the registration +itself need tk_core.lock, so fetch and enable the clock before acquiring +the lock. This preserves the "register before usage" ordering while +keeping clocksource_mutex out of the raw spinlock section. + +clocksource_default_clock() has a second caller, +clocksource_done_booting(), which invokes it with clocksource_mutex already +held. That path avoids a recursive lock because timekeeping_init() has +already run and set cs_jiffies_registered, so the registration is skipped +there. This change does not alter that; it only fixes the invalid wait +context in timekeeping_init(). + +Fixes: f24df84cbe05 ("time/jiffies: Register jiffies clocksource before usage") +Signed-off-by: Mikhail Gavrilov +Signed-off-by: Thomas Gleixner +Reported-by: Breno Leitao +Reported-by: Oleg Nesterov +Reviewed-by: Breno Leitao +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/timekeeping.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -1980,13 +1980,14 @@ void __init timekeeping_init(void) + */ + wall_to_mono = timespec64_sub(boot_offset, wall_time); + ++ clock = clocksource_default_clock(); ++ if (clock->enable) ++ clock->enable(clock); ++ + guard(raw_spinlock_irqsave)(&tk_core.lock); + + ntp_init(); + +- clock = clocksource_default_clock(); +- if (clock->enable) +- clock->enable(clock); + tk_setup_internals(tks, clock); + + tk_set_xtime(tks, &wall_time);