From: Greg Kroah-Hartman Date: Mon, 27 Apr 2026 15:22:49 +0000 (-0600) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=4cf3194cb66203be9891b73387ddc619f30137b0;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch series usb-chipidea-core-allow-ci_irq_handler-handle-both-id-and-vbus-change.patch usb-chipidea-otg-not-wait-vbus-drop-if-use-role_switch.patch usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch --- diff --git a/queue-6.12/alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch b/queue-6.12/alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch new file mode 100644 index 0000000000..4c19464c79 --- /dev/null +++ b/queue-6.12/alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch @@ -0,0 +1,55 @@ +From fca9c850042a7ab4828ce3a9caa8bc40ea09856a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 21 Apr 2026 21:53:52 -0300 +Subject: ALSA: usb-audio: Avoid false E-MU sample-rate notifications +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit fca9c850042a7ab4828ce3a9caa8bc40ea09856a upstream. + +snd_emuusb_set_samplerate() unconditionally notifies the E-MU +SampleRate Extension Unit control after issuing SET_CUR. + +If snd_usb_mixer_set_ctl_value() fails, the control value has not +changed, yet snd_usb_mixer_notify_id() still invalidates the cache and +emits a value-change event to userspace. + +Notify the control only after a successful write. + +Fixes: 7d2b451e65d2 ("ALSA: usb-audio - Added functionality for E-mu 0404USB/0202USB/TrackerPre") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260421-alsa-emuusb-samplerate-notify-v1-1-8b63bbc1d7f1@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer_quirks.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -1559,15 +1559,17 @@ void snd_emuusb_set_samplerate(struct sn + { + struct usb_mixer_interface *mixer; + struct usb_mixer_elem_info *cval; ++ int err; + int unitid = 12; /* SampleRate ExtensionUnit ID */ + + list_for_each_entry(mixer, &chip->mixer_list, list) { + if (mixer->id_elems[unitid]) { + cval = mixer_elem_list_to_info(mixer->id_elems[unitid]); +- snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR, +- cval->control << 8, +- samplerate_id); +- snd_usb_mixer_notify_id(mixer, unitid); ++ err = snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR, ++ cval->control << 8, ++ samplerate_id); ++ if (!err) ++ snd_usb_mixer_notify_id(mixer, unitid); + break; + } + } diff --git a/queue-6.12/alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch b/queue-6.12/alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch new file mode 100644 index 0000000000..ea55f307cc --- /dev/null +++ b/queue-6.12/alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch @@ -0,0 +1,51 @@ +From 52521e8398839105ef8eb22b3f0993f9b0d11a57 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Apr 2026 16:32:19 +0200 +Subject: ALSA: usb-audio: Evaluate packsize caps at the right place + +From: Takashi Iwai + +commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 upstream. + +We introduced the upper bound checks of the packet sizes by the +ep->maxframesize for avoiding the URB submission errors. However, the +check was applied at an incorrect place in the function +snd_usb_endpoint_set_params() where ep->maxframesize isn't defined +yet; the value is defined at a bit later position. So this ended up +with a failure at the first run while the second run works. + +For fixing it, move the check at the correct place, right after the +calculation of ep->maxframesize in the same function. + +Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292 +Cc: +Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -1400,9 +1400,6 @@ int snd_usb_endpoint_set_params(struct s + goto unlock; + } + +- ep->packsize[0] = min(ep->packsize[0], ep->maxframesize); +- ep->packsize[1] = min(ep->packsize[1], ep->maxframesize); +- + /* calculate the frequency in 16.16 format */ + ep->freqm = ep->freqn; + ep->freqshift = INT_MIN; +@@ -1429,6 +1426,9 @@ int snd_usb_endpoint_set_params(struct s + ep->maxframesize = ep->maxpacksize / ep->cur_frame_bytes; + ep->curframesize = ep->curpacksize / ep->cur_frame_bytes; + ++ ep->packsize[0] = min(ep->packsize[0], ep->maxframesize); ++ ep->packsize[1] = min(ep->packsize[1], ep->maxframesize); ++ + err = update_clock_ref_rate(chip, ep); + if (err >= 0) { + ep->need_setup = false; diff --git a/queue-6.12/alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch b/queue-6.12/alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch new file mode 100644 index 0000000000..97d78aa8c3 --- /dev/null +++ b/queue-6.12/alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch @@ -0,0 +1,42 @@ +From a9224f26b754b5034719248891ff3c2ea0d11144 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 21 Apr 2026 22:07:41 -0300 +Subject: ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit a9224f26b754b5034719248891ff3c2ea0d11144 upstream. + +snd_microii_spdif_switch_put() returns 0 when the requested +vendor register value differs from the cached one. + +This comparison was inverted by the resume-support conversion, +so real SPDIF switch toggles are ignored while no-op writes still +issue SET_CUR and report success. + +Return early only when the requested value matches the cached one. + +Fixes: 288673beae6c ("ALSA: usb-audio: Add resume support for MicroII SPDIF ctls") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260421-microii-spdif-switch-fix-v1-1-5c50dc28b88f@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer_quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -2064,7 +2064,7 @@ static int snd_microii_spdif_switch_put( + int err; + + reg = ucontrol->value.integer.value[0] ? 0x28 : 0x2a; +- if (reg != list->kctl->private_value) ++ if (reg == list->kctl->private_value) + return 0; + + kcontrol->private_value = reg; diff --git a/queue-6.12/alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch b/queue-6.12/alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch new file mode 100644 index 0000000000..10cfc176ae --- /dev/null +++ b/queue-6.12/alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch @@ -0,0 +1,45 @@ +From 3c318f97dcc50b2e0556a1813bd6958678e881fd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 15 Apr 2026 12:04:53 -0300 +Subject: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 3c318f97dcc50b2e0556a1813bd6958678e881fd upstream. + +parse_uac2_sample_rate_range() caps the number of enumerated +rates at MAX_NR_RATES, but it only breaks out of the current +rate loop. A malformed UAC2 RANGE response with additional +triplets continues parsing the remaining triplets and repeatedly +prints "invalid uac2 rates" while probe still holds +register_mutex. + +Stop the whole parse once the cap is reached and return the +number of rates collected so far. + +Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()") +Cc: stable@vger.kernel.org +Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820 +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/format.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -458,7 +458,7 @@ static int parse_uac2_sample_rate_range( + nr_rates++; + if (nr_rates >= MAX_NR_RATES) { + usb_audio_err(chip, "invalid uac2 rates\n"); +- break; ++ return nr_rates; + } + + skip_rate: diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..bf25601f84 --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1,7 @@ +alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch +alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch +alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch +usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch +usb-chipidea-otg-not-wait-vbus-drop-if-use-role_switch.patch +usb-chipidea-core-allow-ci_irq_handler-handle-both-id-and-vbus-change.patch +alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch diff --git a/queue-6.12/usb-chipidea-core-allow-ci_irq_handler-handle-both-id-and-vbus-change.patch b/queue-6.12/usb-chipidea-core-allow-ci_irq_handler-handle-both-id-and-vbus-change.patch new file mode 100644 index 0000000000..4ac561f097 --- /dev/null +++ b/queue-6.12/usb-chipidea-core-allow-ci_irq_handler-handle-both-id-and-vbus-change.patch @@ -0,0 +1,105 @@ +From b94b631d9f78e653855f7fb58dbcb86c2a856f6f Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Thu, 2 Apr 2026 15:14:56 +0800 +Subject: usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change + +From: Xu Yang + +commit b94b631d9f78e653855f7fb58dbcb86c2a856f6f upstream. + +For USB role switch-triggered IRQ, ID and VBUS change come together, for +example when switching from host to device mode. ID indicate a role switch +and VBUS is required to determine whether the device controller can start +operating. Currently, ci_irq_handler() handles only a single event per +invocation. This can cause an issue where switching to device mode results +in the device controller not working at all. Allowing ci_irq_handler() to +handle both ID and VBUS change in one call resolves this issue. + +Meanwhile, this change also affects the VBUS event handling logic. +Previously, if an ID event indicated host mode the VBUS IRQ will be +ignored as the device disable BSE when stop() is called. With the new +behavior, if ID and VBUS IRQ occur together and the target mode is host, +the VBUS event is queued and ci_handle_vbus_change() will call +usb_gadget_vbus_connect(), after which USBMODE is switched to device mode, +causing host mode to stop working. To prevent this, an additional check is +added to skip handling VBUS event when current role is not device mode. + +Suggested-by: Peter Chen +Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Yang +Link: https://patch.msgid.link/20260402071457.2516021-2-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/core.c | 45 ++++++++++++++++++++++---------------------- + drivers/usb/chipidea/otg.c | 3 ++ + 2 files changed, 26 insertions(+), 22 deletions(-) + +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -543,30 +543,31 @@ static irqreturn_t ci_irq_handler(int ir + if (ret == IRQ_HANDLED) + return ret; + } +- } + +- /* +- * Handle id change interrupt, it indicates device/host function +- * switch. +- */ +- if (ci->is_otg && (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) { +- ci->id_event = true; +- /* Clear ID change irq status */ +- hw_write_otgsc(ci, OTGSC_IDIS, OTGSC_IDIS); +- ci_otg_queue_work(ci); +- return IRQ_HANDLED; +- } ++ /* ++ * Handle id change interrupt, it indicates device/host function ++ * switch. ++ */ ++ if ((otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) { ++ ci->id_event = true; ++ /* Clear ID change irq status */ ++ hw_write_otgsc(ci, OTGSC_IDIS, OTGSC_IDIS); ++ } + +- /* +- * Handle vbus change interrupt, it indicates device connection +- * and disconnection events. +- */ +- if (ci->is_otg && (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) { +- ci->b_sess_valid_event = true; +- /* Clear BSV irq */ +- hw_write_otgsc(ci, OTGSC_BSVIS, OTGSC_BSVIS); +- ci_otg_queue_work(ci); +- return IRQ_HANDLED; ++ /* ++ * Handle vbus change interrupt, it indicates device connection ++ * and disconnection events. ++ */ ++ if ((otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) { ++ ci->b_sess_valid_event = true; ++ /* Clear BSV irq */ ++ hw_write_otgsc(ci, OTGSC_BSVIS, OTGSC_BSVIS); ++ } ++ ++ if (ci->id_event || ci->b_sess_valid_event) { ++ ci_otg_queue_work(ci); ++ return IRQ_HANDLED; ++ } + } + + /* Handle device/host interrupt */ +--- a/drivers/usb/chipidea/otg.c ++++ b/drivers/usb/chipidea/otg.c +@@ -130,6 +130,9 @@ enum ci_role ci_otg_role(struct ci_hdrc + + void ci_handle_vbus_change(struct ci_hdrc *ci) + { ++ if (ci->role != CI_ROLE_GADGET) ++ return; ++ + if (!ci->is_otg) { + if (ci->platdata->flags & CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS) + usb_gadget_vbus_connect(&ci->gadget); diff --git a/queue-6.12/usb-chipidea-otg-not-wait-vbus-drop-if-use-role_switch.patch b/queue-6.12/usb-chipidea-otg-not-wait-vbus-drop-if-use-role_switch.patch new file mode 100644 index 0000000000..11fdc8805a --- /dev/null +++ b/queue-6.12/usb-chipidea-otg-not-wait-vbus-drop-if-use-role_switch.patch @@ -0,0 +1,37 @@ +From a4e99587102a83ee911c670752fbca694c7e557f Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Thu, 2 Apr 2026 15:14:57 +0800 +Subject: usb: chipidea: otg: not wait vbus drop if use role_switch + +From: Xu Yang + +commit a4e99587102a83ee911c670752fbca694c7e557f upstream. + +The usb role switch will update ID and VBUS states at the same time, and +vbus will not drop when execute data role swap in Type-C usecase. So lets +not wait vbus drop in usb role switch case too. + +Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") +Cc: stable@vger.kernel.org +Acked-by: Peter Chen +Reviewed-by: Jun Li +Signed-off-by: Xu Yang +Link: https://patch.msgid.link/20260402071457.2516021-3-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/otg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/chipidea/otg.c ++++ b/drivers/usb/chipidea/otg.c +@@ -187,8 +187,8 @@ void ci_handle_id_switch(struct ci_hdrc + + ci_role_stop(ci); + +- if (role == CI_ROLE_GADGET && +- IS_ERR(ci->platdata->vbus_extcon.edev)) ++ if (role == CI_ROLE_GADGET && !ci->role_switch && ++ IS_ERR(ci->platdata->vbus_extcon.edev)) + /* + * Wait vbus lower than OTGSC_BSV before connecting + * to host. If connecting status is from an external diff --git a/queue-6.12/usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch b/queue-6.12/usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch new file mode 100644 index 0000000000..671832ef7f --- /dev/null +++ b/queue-6.12/usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch @@ -0,0 +1,63 @@ +From 25e531b422dc2ac90cdae3b6e74b5cdeb081440d Mon Sep 17 00:00:00 2001 +From: Michal Pecio +Date: Thu, 2 Apr 2026 16:13:42 +0300 +Subject: usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() + +From: Michal Pecio + +commit 25e531b422dc2ac90cdae3b6e74b5cdeb081440d upstream. + +xHCI hardware maintains its endpoint state between add_endpoint() +and drop_endpoint() calls followed by successful check_bandwidth(). +So does the driver. + +Core may call endpoint_disable() during xHCI endpoint life, so don't +clear host_ep->hcpriv then, because this breaks endpoint_reset(). + +If a driver calls usb_set_interface(), submits URBs which make host +sequence state non-zero and calls usb_clear_halt(), the device clears +its sequence state but xhci_endpoint_reset() bails out. The next URB +malfunctions: USB2 loses one packet, USB3 gets Transaction Error or +may not complete at all on some (buggy?) HCs from ASMedia and AMD. +This is triggered by uvcvideo on bulk video devices. + +The code was copied from ehci_endpoint_disable() but it isn't needed +here - hcpriv should only be NULL on emulated root hub endpoints. +It might prevent resetting and inadvertently enabling a disabled and +dropped endpoint, but core shouldn't try to reset dropped endpoints. + +Document xhci requirements regarding hcpriv. They are currently met. + +Fixes: 18b74067ac78 ("xhci: Fix use-after-free regression in xhci clear hub TT implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20260402131342.2628648-26-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 1 - + include/linux/usb.h | 3 ++- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3080,7 +3080,6 @@ rescan: + xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n", + ep->ep_state); + done: +- host_ep->hcpriv = NULL; + spin_unlock_irqrestore(&xhci->lock, flags); + } + +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -53,7 +53,8 @@ struct ep_device; + * @ssp_isoc_ep_comp: SuperSpeedPlus isoc companion descriptor for this endpoint + * @urb_list: urbs queued to this endpoint; maintained by usbcore + * @hcpriv: for use by HCD; typically holds hardware dma queue head (QH) +- * with one or more transfer descriptors (TDs) per urb ++ * with one or more transfer descriptors (TDs) per urb; must be preserved ++ * by core while BW is allocated for the endpoint + * @ep_dev: ep_device for sysfs info + * @extra: descriptors following this endpoint in the configuration + * @extralen: how many bytes of "extra" are valid