--- /dev/null
+From fca9c850042a7ab4828ce3a9caa8bc40ea09856a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Tue, 21 Apr 2026 21:53:52 -0300
+Subject: ALSA: usb-audio: Avoid false E-MU sample-rate notifications
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit fca9c850042a7ab4828ce3a9caa8bc40ea09856a upstream.
+
+snd_emuusb_set_samplerate() unconditionally notifies the E-MU
+SampleRate Extension Unit control after issuing SET_CUR.
+
+If snd_usb_mixer_set_ctl_value() fails, the control value has not
+changed, yet snd_usb_mixer_notify_id() still invalidates the cache and
+emits a value-change event to userspace.
+
+Notify the control only after a successful write.
+
+Fixes: 7d2b451e65d2 ("ALSA: usb-audio - Added functionality for E-mu 0404USB/0202USB/TrackerPre")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260421-alsa-emuusb-samplerate-notify-v1-1-8b63bbc1d7f1@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1561,15 +1561,17 @@ void snd_emuusb_set_samplerate(struct sn
+ {
+ struct usb_mixer_interface *mixer;
+ struct usb_mixer_elem_info *cval;
++ int err;
+ int unitid = 12; /* SampleRate ExtensionUnit ID */
+
+ list_for_each_entry(mixer, &chip->mixer_list, list) {
+ if (mixer->id_elems[unitid]) {
+ cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
+- snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
+- cval->control << 8,
+- samplerate_id);
+- snd_usb_mixer_notify_id(mixer, unitid);
++ err = snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
++ cval->control << 8,
++ samplerate_id);
++ if (!err)
++ snd_usb_mixer_notify_id(mixer, unitid);
+ break;
+ }
+ }
--- /dev/null
+From 52521e8398839105ef8eb22b3f0993f9b0d11a57 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 10 Apr 2026 16:32:19 +0200
+Subject: ALSA: usb-audio: Evaluate packsize caps at the right place
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 upstream.
+
+We introduced the upper bound checks of the packet sizes by the
+ep->maxframesize for avoiding the URB submission errors. However, the
+check was applied at an incorrect place in the function
+snd_usb_endpoint_set_params() where ep->maxframesize isn't defined
+yet; the value is defined at a bit later position. So this ended up
+with a failure at the first run while the second run works.
+
+For fixing it, move the check at the correct place, right after the
+calculation of ep->maxframesize in the same function.
+
+Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -1388,9 +1388,6 @@ int snd_usb_endpoint_set_params(struct s
+ goto unlock;
+ }
+
+- ep->packsize[0] = min(ep->packsize[0], ep->maxframesize);
+- ep->packsize[1] = min(ep->packsize[1], ep->maxframesize);
+-
+ /* calculate the frequency in 16.16 format */
+ ep->freqm = ep->freqn;
+ ep->freqshift = INT_MIN;
+@@ -1417,6 +1414,9 @@ int snd_usb_endpoint_set_params(struct s
+ ep->maxframesize = ep->maxpacksize / ep->cur_frame_bytes;
+ ep->curframesize = ep->curpacksize / ep->cur_frame_bytes;
+
++ ep->packsize[0] = min(ep->packsize[0], ep->maxframesize);
++ ep->packsize[1] = min(ep->packsize[1], ep->maxframesize);
++
+ err = update_clock_ref_rate(chip, ep);
+ if (err >= 0) {
+ ep->need_setup = false;
--- /dev/null
+From a9224f26b754b5034719248891ff3c2ea0d11144 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Tue, 21 Apr 2026 22:07:41 -0300
+Subject: ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit a9224f26b754b5034719248891ff3c2ea0d11144 upstream.
+
+snd_microii_spdif_switch_put() returns 0 when the requested
+vendor register value differs from the cached one.
+
+This comparison was inverted by the resume-support conversion,
+so real SPDIF switch toggles are ignored while no-op writes still
+issue SET_CUR and report success.
+
+Return early only when the requested value matches the cached one.
+
+Fixes: 288673beae6c ("ALSA: usb-audio: Add resume support for MicroII SPDIF ctls")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260421-microii-spdif-switch-fix-v1-1-5c50dc28b88f@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -2066,7 +2066,7 @@ static int snd_microii_spdif_switch_put(
+ int err;
+
+ reg = ucontrol->value.integer.value[0] ? 0x28 : 0x2a;
+- if (reg != list->kctl->private_value)
++ if (reg == list->kctl->private_value)
+ return 0;
+
+ kcontrol->private_value = reg;
--- /dev/null
+From 3c318f97dcc50b2e0556a1813bd6958678e881fd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 15 Apr 2026 12:04:53 -0300
+Subject: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 3c318f97dcc50b2e0556a1813bd6958678e881fd upstream.
+
+parse_uac2_sample_rate_range() caps the number of enumerated
+rates at MAX_NR_RATES, but it only breaks out of the current
+rate loop. A malformed UAC2 RANGE response with additional
+triplets continues parsing the remaining triplets and repeatedly
+prints "invalid uac2 rates" while probe still holds
+register_mutex.
+
+Stop the whole parse once the cap is reached and return the
+number of rates collected so far.
+
+Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()")
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/format.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -461,7 +461,7 @@ static int parse_uac2_sample_rate_range(
+ nr_rates++;
+ if (nr_rates >= MAX_NR_RATES) {
+ usb_audio_err(chip, "invalid uac2 rates\n");
+- break;
++ return nr_rates;
+ }
+
+ skip_rate:
rxrpc-fix-missing-validation-of-ticket-length-in-non-xdr-key-preparsing.patch
tty-n_gsm-fix-flow-control-handling-in-tx-path.patch
alsa-usb-audio-fix-race-condition-to-uaf-in-snd_usbmidi_free.patch
+alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch
+alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch
+alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch
+usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch
+alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch
--- /dev/null
+From 25e531b422dc2ac90cdae3b6e74b5cdeb081440d Mon Sep 17 00:00:00 2001
+From: Michal Pecio <michal.pecio@gmail.com>
+Date: Thu, 2 Apr 2026 16:13:42 +0300
+Subject: usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+commit 25e531b422dc2ac90cdae3b6e74b5cdeb081440d upstream.
+
+xHCI hardware maintains its endpoint state between add_endpoint()
+and drop_endpoint() calls followed by successful check_bandwidth().
+So does the driver.
+
+Core may call endpoint_disable() during xHCI endpoint life, so don't
+clear host_ep->hcpriv then, because this breaks endpoint_reset().
+
+If a driver calls usb_set_interface(), submits URBs which make host
+sequence state non-zero and calls usb_clear_halt(), the device clears
+its sequence state but xhci_endpoint_reset() bails out. The next URB
+malfunctions: USB2 loses one packet, USB3 gets Transaction Error or
+may not complete at all on some (buggy?) HCs from ASMedia and AMD.
+This is triggered by uvcvideo on bulk video devices.
+
+The code was copied from ehci_endpoint_disable() but it isn't needed
+here - hcpriv should only be NULL on emulated root hub endpoints.
+It might prevent resetting and inadvertently enabling a disabled and
+dropped endpoint, but core shouldn't try to reset dropped endpoints.
+
+Document xhci requirements regarding hcpriv. They are currently met.
+
+Fixes: 18b74067ac78 ("xhci: Fix use-after-free regression in xhci clear hub TT implementation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20260402131342.2628648-26-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci.c | 1 -
+ include/linux/usb.h | 3 ++-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3233,7 +3233,6 @@ rescan:
+ xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n",
+ ep->ep_state);
+ done:
+- host_ep->hcpriv = NULL;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ }
+
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -54,7 +54,8 @@ struct ep_device;
+ * @ssp_isoc_ep_comp: SuperSpeedPlus isoc companion descriptor for this endpoint
+ * @urb_list: urbs queued to this endpoint; maintained by usbcore
+ * @hcpriv: for use by HCD; typically holds hardware dma queue head (QH)
+- * with one or more transfer descriptors (TDs) per urb
++ * with one or more transfer descriptors (TDs) per urb; must be preserved
++ * by core while BW is allocated for the endpoint
+ * @ep_dev: ep_device for sysfs info
+ * @extra: descriptors following this endpoint in the configuration
+ * @extralen: how many bytes of "extra" are valid
projects / thirdparty / kernel / stable-queue.git / commitdiff
