From: Greg Kroah-Hartman Date: Mon, 27 Apr 2026 15:21:59 +0000 (-0600) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=4f7997a00b0447a3921fcd9b31e0551f7f5ba3f6;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch --- diff --git a/queue-5.15/alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch b/queue-5.15/alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch new file mode 100644 index 0000000000..5ab0137702 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch @@ -0,0 +1,55 @@ +From fca9c850042a7ab4828ce3a9caa8bc40ea09856a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 21 Apr 2026 21:53:52 -0300 +Subject: ALSA: usb-audio: Avoid false E-MU sample-rate notifications +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit fca9c850042a7ab4828ce3a9caa8bc40ea09856a upstream. + +snd_emuusb_set_samplerate() unconditionally notifies the E-MU +SampleRate Extension Unit control after issuing SET_CUR. + +If snd_usb_mixer_set_ctl_value() fails, the control value has not +changed, yet snd_usb_mixer_notify_id() still invalidates the cache and +emits a value-change event to userspace. + +Notify the control only after a successful write. + +Fixes: 7d2b451e65d2 ("ALSA: usb-audio - Added functionality for E-mu 0404USB/0202USB/TrackerPre") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260421-alsa-emuusb-samplerate-notify-v1-1-8b63bbc1d7f1@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer_quirks.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -1561,15 +1561,17 @@ void snd_emuusb_set_samplerate(struct sn + { + struct usb_mixer_interface *mixer; + struct usb_mixer_elem_info *cval; ++ int err; + int unitid = 12; /* SampleRate ExtensionUnit ID */ + + list_for_each_entry(mixer, &chip->mixer_list, list) { + if (mixer->id_elems[unitid]) { + cval = mixer_elem_list_to_info(mixer->id_elems[unitid]); +- snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR, +- cval->control << 8, +- samplerate_id); +- snd_usb_mixer_notify_id(mixer, unitid); ++ err = snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR, ++ cval->control << 8, ++ samplerate_id); ++ if (!err) ++ snd_usb_mixer_notify_id(mixer, unitid); + break; + } + } diff --git a/queue-5.15/alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch b/queue-5.15/alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch new file mode 100644 index 0000000000..2d6e5ba5c5 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch @@ -0,0 +1,51 @@ +From 52521e8398839105ef8eb22b3f0993f9b0d11a57 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Apr 2026 16:32:19 +0200 +Subject: ALSA: usb-audio: Evaluate packsize caps at the right place + +From: Takashi Iwai + +commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 upstream. + +We introduced the upper bound checks of the packet sizes by the +ep->maxframesize for avoiding the URB submission errors. However, the +check was applied at an incorrect place in the function +snd_usb_endpoint_set_params() where ep->maxframesize isn't defined +yet; the value is defined at a bit later position. So this ended up +with a failure at the first run while the second run works. + +For fixing it, move the check at the correct place, right after the +calculation of ep->maxframesize in the same function. + +Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292 +Cc: +Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -1388,9 +1388,6 @@ int snd_usb_endpoint_set_params(struct s + goto unlock; + } + +- ep->packsize[0] = min(ep->packsize[0], ep->maxframesize); +- ep->packsize[1] = min(ep->packsize[1], ep->maxframesize); +- + /* calculate the frequency in 16.16 format */ + ep->freqm = ep->freqn; + ep->freqshift = INT_MIN; +@@ -1417,6 +1414,9 @@ int snd_usb_endpoint_set_params(struct s + ep->maxframesize = ep->maxpacksize / ep->cur_frame_bytes; + ep->curframesize = ep->curpacksize / ep->cur_frame_bytes; + ++ ep->packsize[0] = min(ep->packsize[0], ep->maxframesize); ++ ep->packsize[1] = min(ep->packsize[1], ep->maxframesize); ++ + err = update_clock_ref_rate(chip, ep); + if (err >= 0) { + ep->need_setup = false; diff --git a/queue-5.15/alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch b/queue-5.15/alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch new file mode 100644 index 0000000000..bd7b6bf762 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch @@ -0,0 +1,42 @@ +From a9224f26b754b5034719248891ff3c2ea0d11144 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Tue, 21 Apr 2026 22:07:41 -0300 +Subject: ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit a9224f26b754b5034719248891ff3c2ea0d11144 upstream. + +snd_microii_spdif_switch_put() returns 0 when the requested +vendor register value differs from the cached one. + +This comparison was inverted by the resume-support conversion, +so real SPDIF switch toggles are ignored while no-op writes still +issue SET_CUR and report success. + +Return early only when the requested value matches the cached one. + +Fixes: 288673beae6c ("ALSA: usb-audio: Add resume support for MicroII SPDIF ctls") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260421-microii-spdif-switch-fix-v1-1-5c50dc28b88f@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer_quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -2066,7 +2066,7 @@ static int snd_microii_spdif_switch_put( + int err; + + reg = ucontrol->value.integer.value[0] ? 0x28 : 0x2a; +- if (reg != list->kctl->private_value) ++ if (reg == list->kctl->private_value) + return 0; + + kcontrol->private_value = reg; diff --git a/queue-5.15/alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch b/queue-5.15/alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch new file mode 100644 index 0000000000..8cb7650aea --- /dev/null +++ b/queue-5.15/alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch @@ -0,0 +1,45 @@ +From 3c318f97dcc50b2e0556a1813bd6958678e881fd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 15 Apr 2026 12:04:53 -0300 +Subject: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 3c318f97dcc50b2e0556a1813bd6958678e881fd upstream. + +parse_uac2_sample_rate_range() caps the number of enumerated +rates at MAX_NR_RATES, but it only breaks out of the current +rate loop. A malformed UAC2 RANGE response with additional +triplets continues parsing the remaining triplets and repeatedly +prints "invalid uac2 rates" while probe still holds +register_mutex. + +Stop the whole parse once the cap is reached and return the +number of rates collected so far. + +Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()") +Cc: stable@vger.kernel.org +Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820 +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/format.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -461,7 +461,7 @@ static int parse_uac2_sample_rate_range( + nr_rates++; + if (nr_rates >= MAX_NR_RATES) { + usb_audio_err(chip, "invalid uac2 rates\n"); +- break; ++ return nr_rates; + } + + skip_rate: diff --git a/queue-5.15/series b/queue-5.15/series index 885b2adbba..f28d150dca 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -181,3 +181,8 @@ crypto-ccp-don-t-attempt-to-copy-id-to-userspace-if-psp-command-failed.patch rxrpc-fix-missing-validation-of-ticket-length-in-non-xdr-key-preparsing.patch tty-n_gsm-fix-flow-control-handling-in-tx-path.patch alsa-usb-audio-fix-race-condition-to-uaf-in-snd_usbmidi_free.patch +alsa-usb-audio-stop-parsing-uac2-rates-at-max_nr_rates.patch +alsa-usb-audio-avoid-false-e-mu-sample-rate-notifications.patch +alsa-usb-audio-fix-audio-advantage-micro-ii-spdif-switch.patch +usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch +alsa-usb-audio-evaluate-packsize-caps-at-the-right-place.patch diff --git a/queue-5.15/usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch b/queue-5.15/usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch new file mode 100644 index 0000000000..52c5bef853 --- /dev/null +++ b/queue-5.15/usb-xhci-make-usb_host_endpoint.hcpriv-survive-endpoint_disable.patch @@ -0,0 +1,63 @@ +From 25e531b422dc2ac90cdae3b6e74b5cdeb081440d Mon Sep 17 00:00:00 2001 +From: Michal Pecio +Date: Thu, 2 Apr 2026 16:13:42 +0300 +Subject: usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() + +From: Michal Pecio + +commit 25e531b422dc2ac90cdae3b6e74b5cdeb081440d upstream. + +xHCI hardware maintains its endpoint state between add_endpoint() +and drop_endpoint() calls followed by successful check_bandwidth(). +So does the driver. + +Core may call endpoint_disable() during xHCI endpoint life, so don't +clear host_ep->hcpriv then, because this breaks endpoint_reset(). + +If a driver calls usb_set_interface(), submits URBs which make host +sequence state non-zero and calls usb_clear_halt(), the device clears +its sequence state but xhci_endpoint_reset() bails out. The next URB +malfunctions: USB2 loses one packet, USB3 gets Transaction Error or +may not complete at all on some (buggy?) HCs from ASMedia and AMD. +This is triggered by uvcvideo on bulk video devices. + +The code was copied from ehci_endpoint_disable() but it isn't needed +here - hcpriv should only be NULL on emulated root hub endpoints. +It might prevent resetting and inadvertently enabling a disabled and +dropped endpoint, but core shouldn't try to reset dropped endpoints. + +Document xhci requirements regarding hcpriv. They are currently met. + +Fixes: 18b74067ac78 ("xhci: Fix use-after-free regression in xhci clear hub TT implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20260402131342.2628648-26-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 1 - + include/linux/usb.h | 3 ++- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3233,7 +3233,6 @@ rescan: + xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n", + ep->ep_state); + done: +- host_ep->hcpriv = NULL; + spin_unlock_irqrestore(&xhci->lock, flags); + } + +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -54,7 +54,8 @@ struct ep_device; + * @ssp_isoc_ep_comp: SuperSpeedPlus isoc companion descriptor for this endpoint + * @urb_list: urbs queued to this endpoint; maintained by usbcore + * @hcpriv: for use by HCD; typically holds hardware dma queue head (QH) +- * with one or more transfer descriptors (TDs) per urb ++ * with one or more transfer descriptors (TDs) per urb; must be preserved ++ * by core while BW is allocated for the endpoint + * @ep_dev: ep_device for sysfs info + * @extra: descriptors following this endpoint in the configuration + * @extralen: how many bytes of "extra" are valid