kernel/linux.git/sound, branch v5.15.219

Revert "ALSA: aoa: Use guard() for mutex locks"

2026-08-27T12:28:23+00:00

This reverts commit d956208576ad0dbed1d6145a797144c03e31e9eb. Commit d956208576ad0 ("ALSA: aoa: Use guard() for mutex locks", upstream commit 1cb6ecbb37200) was picked up for 5.15.y only as a Stable-dep-of for 5ed060d54915 ("ALSA: aoa: i2sbus: clear stale prepared state"). 5.15.y still builds with '-std=gnu89' and '-Wdeclaration-after-statement', so the guard() and scoped_guard() helpers cannot be used here at all: the CLASS() declaration that guard() expands to is a declaration in the middle of a block, and scoped_guard() declares its variable in a for() init clause. With CONFIG_WERROR=y (allmodconfig) this breaks the powerpc build: sound/aoa/core/gpio-pmf.c: In function 'pmf_set_notify': ./include/linux/cleanup.h:86:9: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement] sound/aoa/codecs/tas.c: In function 'tas_switch_clock': ./include/linux/cleanup.h:112:9: error: 'for' loop initial declarations are only allowed in C99 or C11 mode Revert the cleanup so that sound/aoa goes back to explicit mutex_lock()/mutex_unlock() pairs. As it was a pure refactoring with no behaviour change, nothing is lost. The two fixes that were queued on top of it are kept and re-adapted to the explicit locking in sound/aoa/soundbus/i2sbus/pcm.c: - 2c38191380740 ("ALSA: aoa: i2sbus: clear stale prepared state"): i2sbus_pcm_clear_active() now takes and drops i2sdev->lock explicitly, and i2sbus_pcm_prepare() sets pi->active only on the success paths, which are now reached via 'goto out_unlock' with result == 0. - d17c282163b70 ("ALSA: aoa: Skip devices with no codecs in i2sbus_resume()"): the list_first_entry() conversion in i2sbus_pcm_prepare() is kept. Signed-off-by: Sasha Levin

ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

2026-08-27T12:28:21+00:00

[ Upstream commit 1ba381759e45d5d0442452cfa5c42e836191a568 ] The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed. On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL: snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro") Assisted-by: Claude:claude-fable-5 Cc: stable@vger.kernel.org Signed-off-by: Dawid Wróbel Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260730-worktree-lpass-tx-macro-enum-fix-v2-1-6d091c736116@dawidwrobel.com Signed-off-by: Mark Brown [ kept `snd_soc_kcontrol_component()` context line instead of upstream's renamed `snd_kcontrol_chip()` ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ALSA: dummy: Check card index validity at probe

2026-08-27T12:28:18+00:00

commit 02442d5fe8ee365a084b055d4fa81a0c1abfc3fd upstream. snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Reported-by: syzbot+2fb5d1f7cc4c1f132bcc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a73bd4d.01d0871a.3a0d52.0005.GAE@google.com Cc: Link: https://patch.msgid.link/20260806100433.1287393-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

2026-08-23T12:17:31+00:00

[ Upstream commit f12afefb7b01f94d6d66d397f323a9914edbf70e ] The irq handlers take a struct device pointer and call dev_get_drvdata() to obtain the driver data. However, the driver data is only set at the end of probe, after devm_request_irq(), so an interrupt taken in between causes the handlers to pass a NULL pointer to readl() and crash. Pass the private data directly as the devm_request_irq() argument instead of the device pointer, matching what the handlers expect. Fixes: 6f6c3c36f091 ("ASoC: xlnx: add pcm formatter platform driver") Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Rosen Penev Reviewed-by: Michal Simek Link: https://patch.msgid.link/20260806233231.30631-1-rosenp@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin

ALSA: seq: close a re-opened queue timer in the destructor

2026-08-23T12:17:26+00:00

[ Upstream commit 2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9 ] queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd_seq_timer_delete() frees q->timer. A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT that took a queueptr() use_lock reference before the queue was unlinked runs snd_seq_timer_open() after the close. Open refuses re-open only while timeri is set, and the close just cleared it, so it re-opens timeri. snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop() is a no-op, because running was cleared first. So it frees q->timer with the instance still live. The queue is freed next. The instance stays on the global timer with callback_data pointing at the freed queue. A non-owner START on the unlocked queue arms it. The next tick derefs the freed queue in snd_seq_timer_interrupt(). Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and no queue ownership required. Close any lingering instance in the destructor. There, ->timeri can no longer change: the queue is unlinked and all use_lock borrowers have drained, so no snd_seq_queue_use() can re-open it. Close it before clearing q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt() to finish, and that callback still reads q->timer (via snd_seq_check_queue()), so q->timer must stay valid until it drains. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei Link: https://patch.msgid.link/422FDB81-2A68-47C7-A22D-2D3301E2E86D@doyensec.com Signed-off-by: Takashi Iwai [ replaced scoped_guard(spinlock_irq, &t->lock) with explicit spin_lock_irq()/spin_unlock_irq() pair since gnu89-compiled 5.15 rejects the macro's for-loop declarations ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ASoC: mediatek: mt8192: Check runtime resume during probe

2026-08-23T12:17:20+00:00

[ Upstream commit e24d5dde56a50946020b134fa8448869093db76a ] The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pm_runtime_get_sync() without checking the return value. If runtime resume fails, probe keeps going without the device necessarily being accessible, and pm_runtime_get_sync() may leave the PM usage count incremented. The regmap_reinit_cache() failure path also returns before dropping the temporary PM reference and before clearing pm_runtime_bypass_reg_ctl. Use pm_runtime_resume_and_get() so resume failures do not leak a usage count, and clear the temporary bypass flag after dropping the probe PM reference on all regmap_reinit_cache() outcomes. Fixes: 125ab5d588b0 ("ASoC: mediatek: mt8192: add platform driver") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260527-asoc-mt8192-probe-cleanup-v1-2-1bb834d05b72@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable

2026-08-23T12:17:20+00:00

[ Upstream commit 01981565c764c554cc96e2d30a71c42975171416 ] Simplify the function mt8192_afe_pcm_dev_probe() by using local 'dev' instead of '&pdev->dev'. Signed-off-by: Tang Bin Link: https://patch.msgid.link/20241025080026.2393-1-tangbin@cmss.chinamobile.com Signed-off-by: Mark Brown Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb

2026-08-23T12:17:20+00:00

[ Upstream commit 1d2a6b3b5189b6c3e51f29e050aa9b2337b774e8 ] Since the mtk-afe-platform-driver generic mtk_afe_pcm_platform now has a common .probe() callback, there is no reason to keep duplicating this function over and over in the SoC specific AFE-PCM drivers: switch over to register with the common bits instead. Note that MT8186 was left out of this because it is registering some extra sinegen controls in the AFE-PCM probe callback and needs extra cleanups to be able to use the common bits. Reviewed-by: Alexandre Mergnat Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20240416071410.75620-13-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()

2026-08-23T12:17:20+00:00

[ Upstream commit 324c603a4efca7d1045e0bf3477ca54970eac72c ] Simplify the probe function by switching error prints to return dev_err_probe(), lowering the lines count; while at it, also beautify some messages and change some others' level from warn to error. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://msgid.link/r/20240313110147.1267793-3-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()

2026-08-23T12:17:20+00:00

[ Upstream commit 7aaaa22de56ce0dae15fd9f42a69a1d1a7a6e078 ] Switch from pm_runtime_enable() to devm_pm_runtime_enable(), allowing to remove all gotos from the probe function. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://msgid.link/r/20240313110147.1267793-2-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown Stable-dep-of: e24d5dde56a5 ("ASoC: mediatek: mt8192: Check runtime resume during probe") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman