--- /dev/null
+From fca9c850042a7ab4828ce3a9caa8bc40ea09856a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Tue, 21 Apr 2026 21:53:52 -0300
+Subject: ALSA: usb-audio: Avoid false E-MU sample-rate notifications
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit fca9c850042a7ab4828ce3a9caa8bc40ea09856a upstream.
+
+snd_emuusb_set_samplerate() unconditionally notifies the E-MU
+SampleRate Extension Unit control after issuing SET_CUR.
+
+If snd_usb_mixer_set_ctl_value() fails, the control value has not
+changed, yet snd_usb_mixer_notify_id() still invalidates the cache and
+emits a value-change event to userspace.
+
+Notify the control only after a successful write.
+
+Fixes: 7d2b451e65d2 ("ALSA: usb-audio - Added functionality for E-mu 0404USB/0202USB/TrackerPre")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260421-alsa-emuusb-samplerate-notify-v1-1-8b63bbc1d7f1@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1559,15 +1559,17 @@ void snd_emuusb_set_samplerate(struct sn
+ {
+ struct usb_mixer_interface *mixer;
+ struct usb_mixer_elem_info *cval;
++ int err;
+ int unitid = 12; /* SampleRate ExtensionUnit ID */
+
+ list_for_each_entry(mixer, &chip->mixer_list, list) {
+ if (mixer->id_elems[unitid]) {
+ cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
+- snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
+- cval->control << 8,
+- samplerate_id);
+- snd_usb_mixer_notify_id(mixer, unitid);
++ err = snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
++ cval->control << 8,
++ samplerate_id);
++ if (!err)
++ snd_usb_mixer_notify_id(mixer, unitid);
+ break;
+ }
+ }
--- /dev/null
+From 52521e8398839105ef8eb22b3f0993f9b0d11a57 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 10 Apr 2026 16:32:19 +0200
+Subject: ALSA: usb-audio: Evaluate packsize caps at the right place
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 upstream.
+
+We introduced the upper bound checks of the packet sizes by the
+ep->maxframesize for avoiding the URB submission errors. However, the
+check was applied at an incorrect place in the function
+snd_usb_endpoint_set_params() where ep->maxframesize isn't defined
+yet; the value is defined at a bit later position. So this ended up
+with a failure at the first run while the second run works.
+
+For fixing it, move the check at the correct place, right after the
+calculation of ep->maxframesize in the same function.
+
+Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -1400,9 +1400,6 @@ int snd_usb_endpoint_set_params(struct s
+ goto unlock;
+ }
+
+- ep->packsize[0] = min(ep->packsize[0], ep->maxframesize);
+- ep->packsize[1] = min(ep->packsize[1], ep->maxframesize);
+-
+ /* calculate the frequency in 16.16 format */
+ ep->freqm = ep->freqn;
+ ep->freqshift = INT_MIN;
+@@ -1429,6 +1426,9 @@ int snd_usb_endpoint_set_params(struct s
+ ep->maxframesize = ep->maxpacksize / ep->cur_frame_bytes;
+ ep->curframesize = ep->curpacksize / ep->cur_frame_bytes;
+
++ ep->packsize[0] = min(ep->packsize[0], ep->maxframesize);
++ ep->packsize[1] = min(ep->packsize[1], ep->maxframesize);
++
+ err = update_clock_ref_rate(chip, ep);
+ if (err >= 0) {
+ ep->need_setup = false;
--- /dev/null
+From a9224f26b754b5034719248891ff3c2ea0d11144 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Tue, 21 Apr 2026 22:07:41 -0300
+Subject: ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit a9224f26b754b5034719248891ff3c2ea0d11144 upstream.
+
+snd_microii_spdif_switch_put() returns 0 when the requested
+vendor register value differs from the cached one.
+
+This comparison was inverted by the resume-support conversion,
+so real SPDIF switch toggles are ignored while no-op writes still
+issue SET_CUR and report success.
+
+Return early only when the requested value matches the cached one.
+
+Fixes: 288673beae6c ("ALSA: usb-audio: Add resume support for MicroII SPDIF ctls")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260421-microii-spdif-switch-fix-v1-1-5c50dc28b88f@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -2064,7 +2064,7 @@ static int snd_microii_spdif_switch_put(
+ int err;
+
+ reg = ucontrol->value.integer.value[0] ? 0x28 : 0x2a;
+- if (reg != list->kctl->private_value)
++ if (reg == list->kctl->private_value)
+ return 0;
+
+ kcontrol->private_value = reg;
--- /dev/null
+From 3c318f97dcc50b2e0556a1813bd6958678e881fd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 15 Apr 2026 12:04:53 -0300
+Subject: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 3c318f97dcc50b2e0556a1813bd6958678e881fd upstream.
+
+parse_uac2_sample_rate_range() caps the number of enumerated
+rates at MAX_NR_RATES, but it only breaks out of the current
+rate loop. A malformed UAC2 RANGE response with additional
+triplets continues parsing the remaining triplets and repeatedly
+prints "invalid uac2 rates" while probe still holds
+register_mutex.
+
+Stop the whole parse once the cap is reached and return the
+number of rates collected so far.
+
+Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()")
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/format.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -458,7 +458,7 @@ static int parse_uac2_sample_rate_range(
+ nr_rates++;
+ if (nr_rates >= MAX_NR_RATES) {
+ usb_audio_err(chip, "invalid uac2 rates\n");
+- break;
++ return nr_rates;
+ }
+
+ skip_rate:
--- /dev/null
+alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch
+alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch
+alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch
+usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch
+usb-chipidea-otg-not-wait-vbus-drop-if-use-role_switch.patch
+usb-chipidea-core-allow-ci_irq_handler-handle-both-id-and-vbus-change.patch
+alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch
--- /dev/null
+From b94b631d9f78e653855f7fb58dbcb86c2a856f6f Mon Sep 17 00:00:00 2001
+From: Xu Yang <xu.yang_2@nxp.com>
+Date: Thu, 2 Apr 2026 15:14:56 +0800
+Subject: usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+commit b94b631d9f78e653855f7fb58dbcb86c2a856f6f upstream.
+
+For USB role switch-triggered IRQ, ID and VBUS change come together, for
+example when switching from host to device mode. ID indicate a role switch
+and VBUS is required to determine whether the device controller can start
+operating. Currently, ci_irq_handler() handles only a single event per
+invocation. This can cause an issue where switching to device mode results
+in the device controller not working at all. Allowing ci_irq_handler() to
+handle both ID and VBUS change in one call resolves this issue.
+
+Meanwhile, this change also affects the VBUS event handling logic.
+Previously, if an ID event indicated host mode the VBUS IRQ will be
+ignored as the device disable BSE when stop() is called. With the new
+behavior, if ID and VBUS IRQ occur together and the target mode is host,
+the VBUS event is queued and ci_handle_vbus_change() will call
+usb_gadget_vbus_connect(), after which USBMODE is switched to device mode,
+causing host mode to stop working. To prevent this, an additional check is
+added to skip handling VBUS event when current role is not device mode.
+
+Suggested-by: Peter Chen <peter.chen@kernel.org>
+Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Link: https://patch.msgid.link/20260402071457.2516021-2-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/core.c | 45 ++++++++++++++++++++++----------------------
+ drivers/usb/chipidea/otg.c | 3 ++
+ 2 files changed, 26 insertions(+), 22 deletions(-)
+
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -543,30 +543,31 @@ static irqreturn_t ci_irq_handler(int ir
+ if (ret == IRQ_HANDLED)
+ return ret;
+ }
+- }
+
+- /*
+- * Handle id change interrupt, it indicates device/host function
+- * switch.
+- */
+- if (ci->is_otg && (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) {
+- ci->id_event = true;
+- /* Clear ID change irq status */
+- hw_write_otgsc(ci, OTGSC_IDIS, OTGSC_IDIS);
+- ci_otg_queue_work(ci);
+- return IRQ_HANDLED;
+- }
++ /*
++ * Handle id change interrupt, it indicates device/host function
++ * switch.
++ */
++ if ((otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) {
++ ci->id_event = true;
++ /* Clear ID change irq status */
++ hw_write_otgsc(ci, OTGSC_IDIS, OTGSC_IDIS);
++ }
+
+- /*
+- * Handle vbus change interrupt, it indicates device connection
+- * and disconnection events.
+- */
+- if (ci->is_otg && (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) {
+- ci->b_sess_valid_event = true;
+- /* Clear BSV irq */
+- hw_write_otgsc(ci, OTGSC_BSVIS, OTGSC_BSVIS);
+- ci_otg_queue_work(ci);
+- return IRQ_HANDLED;
++ /*
++ * Handle vbus change interrupt, it indicates device connection
++ * and disconnection events.
++ */
++ if ((otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) {
++ ci->b_sess_valid_event = true;
++ /* Clear BSV irq */
++ hw_write_otgsc(ci, OTGSC_BSVIS, OTGSC_BSVIS);
++ }
++
++ if (ci->id_event || ci->b_sess_valid_event) {
++ ci_otg_queue_work(ci);
++ return IRQ_HANDLED;
++ }
+ }
+
+ /* Handle device/host interrupt */
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -130,6 +130,9 @@ enum ci_role ci_otg_role(struct ci_hdrc
+
+ void ci_handle_vbus_change(struct ci_hdrc *ci)
+ {
++ if (ci->role != CI_ROLE_GADGET)
++ return;
++
+ if (!ci->is_otg) {
+ if (ci->platdata->flags & CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS)
+ usb_gadget_vbus_connect(&ci->gadget);
--- /dev/null
+From a4e99587102a83ee911c670752fbca694c7e557f Mon Sep 17 00:00:00 2001
+From: Xu Yang <xu.yang_2@nxp.com>
+Date: Thu, 2 Apr 2026 15:14:57 +0800
+Subject: usb: chipidea: otg: not wait vbus drop if use role_switch
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+commit a4e99587102a83ee911c670752fbca694c7e557f upstream.
+
+The usb role switch will update ID and VBUS states at the same time, and
+vbus will not drop when execute data role swap in Type-C usecase. So lets
+not wait vbus drop in usb role switch case too.
+
+Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way")
+Cc: stable@vger.kernel.org
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Reviewed-by: Jun Li <jun.li@nxp.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Link: https://patch.msgid.link/20260402071457.2516021-3-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/otg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -187,8 +187,8 @@ void ci_handle_id_switch(struct ci_hdrc
+
+ ci_role_stop(ci);
+
+- if (role == CI_ROLE_GADGET &&
+- IS_ERR(ci->platdata->vbus_extcon.edev))
++ if (role == CI_ROLE_GADGET && !ci->role_switch &&
++ IS_ERR(ci->platdata->vbus_extcon.edev))
+ /*
+ * Wait vbus lower than OTGSC_BSV before connecting
+ * to host. If connecting status is from an external
--- /dev/null
+From 25e531b422dc2ac90cdae3b6e74b5cdeb081440d Mon Sep 17 00:00:00 2001
+From: Michal Pecio <michal.pecio@gmail.com>
+Date: Thu, 2 Apr 2026 16:13:42 +0300
+Subject: usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+commit 25e531b422dc2ac90cdae3b6e74b5cdeb081440d upstream.
+
+xHCI hardware maintains its endpoint state between add_endpoint()
+and drop_endpoint() calls followed by successful check_bandwidth().
+So does the driver.
+
+Core may call endpoint_disable() during xHCI endpoint life, so don't
+clear host_ep->hcpriv then, because this breaks endpoint_reset().
+
+If a driver calls usb_set_interface(), submits URBs which make host
+sequence state non-zero and calls usb_clear_halt(), the device clears
+its sequence state but xhci_endpoint_reset() bails out. The next URB
+malfunctions: USB2 loses one packet, USB3 gets Transaction Error or
+may not complete at all on some (buggy?) HCs from ASMedia and AMD.
+This is triggered by uvcvideo on bulk video devices.
+
+The code was copied from ehci_endpoint_disable() but it isn't needed
+here - hcpriv should only be NULL on emulated root hub endpoints.
+It might prevent resetting and inadvertently enabling a disabled and
+dropped endpoint, but core shouldn't try to reset dropped endpoints.
+
+Document xhci requirements regarding hcpriv. They are currently met.
+
+Fixes: 18b74067ac78 ("xhci: Fix use-after-free regression in xhci clear hub TT implementation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20260402131342.2628648-26-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci.c | 1 -
+ include/linux/usb.h | 3 ++-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3080,7 +3080,6 @@ rescan:
+ xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n",
+ ep->ep_state);
+ done:
+- host_ep->hcpriv = NULL;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ }
+
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -53,7 +53,8 @@ struct ep_device;
+ * @ssp_isoc_ep_comp: SuperSpeedPlus isoc companion descriptor for this endpoint
+ * @urb_list: urbs queued to this endpoint; maintained by usbcore
+ * @hcpriv: for use by HCD; typically holds hardware dma queue head (QH)
+- * with one or more transfer descriptors (TDs) per urb
++ * with one or more transfer descriptors (TDs) per urb; must be preserved
++ * by core while BW is allocated for the endpoint
+ * @ep_dev: ep_device for sysfs info
+ * @extra: descriptors following this endpoint in the configuration
+ * @extralen: how many bytes of "extra" are valid
projects / thirdparty / kernel / stable-queue.git / commitdiff
