Merge tag 'sound-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes. Most of them are device-specific fixes
while there are a few core fixes. The continued flux, but not too
scaring yet. Some highlights below.
ALSA Core:
- Fix potential UAF after asynchronous card release
- Fix a race condition in PCM timer initialization order
USB-Audio:
- Hardening fixes for issues reported by fuzzer for 6fire, bcd2000,
and implicit FB packets
- Fix double list addition in implicit FB handling
- Quirks for AVerMedia GC553Pro and Behringer FCA1616
HD-Audio:
- Quirks / fixes for HP OmniBook 7, OMEN 15, and Victus 15 laptops
[33 lines not shown]
Merge tag 'pwrseq-fixes-for-v7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing fixes from Bartosz Golaszewski:
- fix kconfig issue in pwrseq-thread-gpu
- fix error path logic in pwrseq_unit_enable()
- fix two NULL-pointer dereference bugs in power sequencing core
* tag 'pwrseq-fixes-for-v7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed
power: sequencing: Fix build issue with COMPILE_TEST
Merge tag 'gpio-fixes-for-v7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
- fix fwnode reference leak on failure in shared GPIO handling
- fix regression in OF_POPULATED logic after the unification of GPIO
hog handling between OF, ACPI and machine variants
- don't call free_irq() if no IRQ is installed in gpio-virtuser
* tag 'gpio-fixes-for-v7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
gpio: virtuser: skip free_irq when no IRQ is installed
gpiolib: of: don't mark hog nodes OF_POPULATED before a chip is found
gpiolib: Put fwnode reference on failure
Merge tag 'dma-mapping-7.3-2026-09-17' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
Pull dma-mapping fixes from Marek Szyprowski:
"A few fixes for the DMA-mapping code:
- resolved regression in accessing encrypted memory by IOMMU-backed
devices (Aneesh Kumar K.V)
- improved failure handling and removed rare bug in swiotlb/highmem
(Donggeun Yoo)"
* tag 'dma-mapping-7.3-2026-09-17' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
x86/mm: Don't force unencrypted DMA for IOMMU-backed devices
dma-mapping: don't trace the DMA address when the allocation fails
swiotlb: use the adjusted address for the highmem page lookup
dma-coherent: report a failed reserved memory assignment
Merge tag 'asoc-fix-v7.3-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v7.3
A relatively large pile of fixes here, a lot of driver specific stuff
that's broadly unremarkable plus a few core fixes from Richard that fix
issues where SoundWire systems with multiple CODECs on the same link
would configure the CODECs to use the same bus slots leading to broken
audio.
ASoC: adau1977-i2c: add OF match table for I2C
Like for SPI, the I2C driver needs an OF match table for the kernel to
be able to automatically load the driver when built as a module. Add
one.
Signed-off-by: Alvin Šipraga <alvin.sipraga at analog.com>
Reviewed-by: Nuno Sá <nuno.sa at analog.com>
Link: https://patch.msgid.link/20260914-asoc-adau1977-fixes-v1-3-aa2f0cabd728@analog.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: adau1977-spi: drop __maybe_unused and of_match_ptr()
Since commit 5ab23c7923a1 ("modpost: Create modalias for builtin
modules") MODULE_DEVICE_TABLE() is enough to reference a match table and
the data isn't discarded by the linker even when the driver is built-in
and CONFIG_OF is disabled. Drop the of_match_ptr() wrapping so that OF
matching keeps working regardless of CONFIG_OF. This also means we can
drop __maybe_unused since it's always used.
The entries in adau1977_spi_of_match were also erroneously indented with
spaces - replace the indentation with tabs to conform with coding style.
Signed-off-by: Alvin Šipraga <alvin.sipraga at analog.com>
Reviewed-by: Nuno Sá <nuno.sa at analog.com>
Link: https://patch.msgid.link/20260914-asoc-adau1977-fixes-v1-2-aa2f0cabd728@analog.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: adau1977: make the Kconfig symbols user selectable
SND_SOC_ADAU1977_{SPI,I2C} are missing Kconfig text, so they don't show
up in menuconfig and can't be selected by a user - only by another
symbol such as a machine driver. Add the text to make these symbols
selectable and usable with generic machine drivers like the simple audio
card.
Signed-off-by: Alvin Šipraga <alvin.sipraga at analog.com>
Reviewed-by: Nuno Sá <nuno.sa at analog.com>
Link: https://patch.msgid.link/20260914-asoc-adau1977-fixes-v1-1-aa2f0cabd728@analog.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: amd: acp: SoundWire machine driver fixes
Vijendar Mukunda <Vijendar.Mukunda at amd.com> says:
This series fixes four defects in the AMD ACP SoundWire machine drivers
(acp-sdw-legacy-mach.c and acp-sdw-sof-mach.c).
A bounds check is added to validate the SoundWire link ID before it is
used as an array index in create_sdw_dailink(), preventing out-of-bounds
access when an unexpected link_mask value is encountered. The codec
config count in the SOF machine driver is refactored to use a dedicated
variable rather than reusing the endpoint-count variable for two
purposes, making the intent clearer and avoiding a stale value being
passed to the codec config array. An operator-precedence bug in the
ffs(link_mask - 1) expression is corrected to ffs(link_mask) - 1,
ensuring the link ID is derived from the correct bit position. Finally,
the SOF machine driver card name is shortened to fit within the 16-byte
snd_card driver[] field and eliminate a compile-time warning.
Link: https://patch.msgid.link/20260910161728.1452808-1-Vijendar.Mukunda@amd.com
ASoC: amd: acp: fix card name length warning in SOF SoundWire machine driver
The ALSA snd_card driver[] field is 16 bytes (including the NUL
terminator), leaving 15 usable characters. The SOF framework
prepends a "sof-" prefix when registering the card, so
card->name = "amd-soundwire" becomes driver name "sof-amd-soundwire"
which is 17 characters and overflows the driver[16] buffer, triggering
a kernel warning.
Fix by shortening the card name to "amd-sdw"; the resulting driver
name "sof-amd-sdw" fits within the 15-character limit.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda at amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1 at kernel.org>
Link: https://patch.msgid.link/20260910161728.1452808-5-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID
ffs(link_mask - 1) computes ffs on (link_mask - 1) instead of
subtracting 1 from the result of ffs(link_mask). For a typical
power-of-2 link_mask this returns the wrong link ID, causing cpu_pin_id
lookup to select the incorrect SoundWire manager.
Fix the operator precedence to ffs(link_mask) - 1 in both
acp-sdw-sof-mach.c and acp-sdw-legacy-mach.c.
Fixes: 6d8348ddc56e ("ASoC: amd: acp: refactor SoundWire machine driver code")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda at amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1 at kernel.org>
Link: https://patch.msgid.link/20260910161728.1452808-4-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver
num_devs was used both as the endpoint count and as the output for
asoc_sdw_parse_sdw_endpoints(), which overwrites it with the codec
configuration count. Introduce a separate num_confs variable to hold
the codec conf count so the two values remain distinct across
codec_conf allocation and card->num_configs assignment.
Fixes: 6d8348ddc56e ("ASoC: amd: acp: refactor SoundWire machine driver code")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda at amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1 at kernel.org>
Link: https://patch.msgid.link/20260910161728.1452808-3-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers
Add a bounds check in create_sdw_dailink() to validate that the
SoundWire link ID derived from link_mask does not exceed the maximum
supported by the platform. If the link ID is out of range or link_mask
is zero, log an error and return -EINVAL to prevent accessing invalid
CPU pin ID tables.
Applied to both acp-sdw-sof-mach.c and acp-sdw-legacy-mach.c.
Fixes: 6d8348ddc56e ("ASoC: amd: acp: refactor SoundWire machine driver code")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda at amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1 at kernel.org>
Link: https://patch.msgid.link/20260910161728.1452808-2-Vijendar.Mukunda@amd.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length
In cs_amp_alloc_get_efi_variable() the first call to
cs_amp_get_efi_variable() might return EFI_SUCCESS if the variable
exists with zero length. Trap this and return -ENOENT to prevent
returning an unexpected NULL pointer.
The first cs_amp_get_efi_variable() call was assumed to return
EFI_BUFFER_TOO_SMALL if the variable existed, but if instead it
returned EFI_SUCCESS this would be converted to 0 by
cs_amp_convert_efi_status() and then be returned as a NULL pointer.
Fixes: 00fd40bc7acec ("ASoC: cs-amp-lib: Support Dell SSIDExV2 UEFI variable")
Signed-off-by: Richard Fitzgerald <rf at opensource.cirrus.com>
Link: https://patch.msgid.link/20260914122611.2783563-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
stream_config is not initialized before being passed to
sdw_stream_add_slave(). The type field may contain garbage and is
later copied to stream->type by sdw_config_stream().
Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.
While at it, use snd_sdw_params_to_config() helper instead of
open-coding the same logic.
Fixes: 63a511284c9e ("ASoC: rt712-sdca: Add RT712 SDCA driver for Mic topology")
Cc: stable at vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan at kylinos.cn>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart at linux.dev>
Link: https://patch.msgid.link/20260914104712.379574-1-yijiangshan@kylinos.cn
Signed-off-by: Mark Brown <broonie at kernel.org>
ASoC: hdmi-codec: Report a change when the channel status moves
The put() callback of "IEC958 Playback Default" stores all 24 channel
status bytes and then returns 0. The core notifies userspace only on a
positive return, so a write that changes what the get() callback hands
back is never announced, and a mixer holding the control open keeps
showing the old value.
Compare the stored bytes and return 1 when they move, the way
snd_hda_spdif_default_put() does.
The same shape is in img-spdif-out and uniperif_player.
No board with this codec was to hand. The change is a comparison of
driver state with no hardware behaviour in it, and mixer-test counts the
missing notification as event_missing.
Fixes: 7a8e1d44211e ("ASoC: hdmi-codec: Add iec958 controls")
Signed-off-by: HyeongJun An <sammiee5311 at gmail.com>
[3 lines not shown]
ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
arm allmodconfig fails to build with gcc:
In file included from sound/soc/ux500/ux500_msp_i2s.c:20:
sound/soc/ux500/ux500_msp_i2s.h:151:38: error: suggest parentheses
around arithmetic in operand of '^' [-Werror=parentheses]
sound/soc/ux500/ux500_msp_i2s.c:204:21: note: in expansion of macro
'MSP_TX_CLKPOL_BIT'
cc1: all warnings being treated as errors
The macros never parenthesized their argument:
#define MSP_TX_CLKPOL_BIT(n) ((n & TCKPOL_MASK) << TCKPOL_SHIFT)
That went unnoticed while every caller passed a plain variable, but
configure_protocol() now passes an XOR expression, which binds as
"a ^ (b & MASK)" rather than "(a ^ b) & MASK", and gcc rightly
complains.
[15 lines not shown]
ASoC: rt721: Reset codec to fix abnormal sound
The audio output may become abnormal after a warm reboot from Windows.
Reset the codec once during hardware initialization to restore it to a
known state and prevent the issue.
Signed-off-by: Oder Chiou <oder_chiou at realtek.com>
Link: https://patch.msgid.link/20260916101803.2301508-1-oder_chiou@realtek.com
Signed-off-by: Mark Brown <broonie at kernel.org>
Merge tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan:
"KVM:
- fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- fix secure device page leak on uv_page_in() failure
iommu:
- Fix the overflow validation in iommu_tce_check_ioba
Thanks to Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R
Nageswara Sastry, and Shivaprasad G Bhat"
* tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified
IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().
While doing so, the passed in argument npages is ignored and constant
value '1' is used leaving out a possible overflow as the callers can
legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT
cases.
Fix this by accounting for 'npages', checking for arithmetic overflow,
and verifying that the entire requested range (ioba - offset + npages)
does not exceed the table capacity 'size'.
Fixes: b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking")
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list at gmail.com>
Tested-by: R Nageswara Sastry <rnsastry at linux.ibm.com>
Signed-off-by: Shivaprasad G Bhat <sbhat at linux.ibm.com>
Signed-off-by: Gautam Menghani <gautam at linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy at linux.ibm.com>
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
In kvmppc_svm_page_in(), if uv_page_in() fails after
kvmppc_uvmem_get_page() has succeeded, the secure device page is never
released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
refcount=1 and locks the page. The subsequent goto out_finalize skips
the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
page, and none of those resources are ever reclaimed.
Each occurrence permanently consumes one entry from the firmware-bounded
secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
marked as secure — making it unusable for the lifetime of the VM.
The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
failure correctly with unlock_page(dpage); __free_page(dpage). Apply
the same pattern here: unlock_page() followed by put_page(), which
chains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
[11 lines not shown]
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
reference on the kvm_nested_guest pointer obtained from the IDR. A
concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /
--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
the iterating vCPU with a dangling pointer. The subsequent
mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
gp->shadow_lpid and gp->l1_host all touch freed memory. The free path
is fully L1-controlled.
Fix this by incrementing gp->refcnt inside the loop before dropping
mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
reference with kvmhv_put_nested() after the per-guest work completes.
This is the same get/put discipline already used at every other
call site that drops mmu_lock while holding a nested-guest pointer.
[6 lines not shown]
ALSA: usb-audio: fix list_add double-add in push_back_to_ready_list
stop_urbs() clears ep->ready_playback_urbs with a bare INIT_LIST_HEAD()
instead of unlinking each queued snd_urb_ctx. If a URB survives past
wait_clear_urbs()'s forced STOPPING->STOPPED timeout, its ctx is left
looking "linked" (stale next/prev) even though the list head has
forgotten it. When the endpoint later restarts and re-queues that same
ctx onto the (now real) ready list, and the old URB's completion
handler then calls push_back_to_ready_list() for it a second time, the
ctx is still the list's own tail and list_add's double-add check trips:
kernel BUG at lib/list_debug.c:35 (list_add double add)
Guard push_back_to_ready_list() with a list_empty() check so a
still-linked ctx isn't re-added, and make stop_urbs() actually unlink
each ctx via list_del_init() instead of only resetting the head, so a
dropped ctx doesn't keep looking linked to that guard.
Reported-by: syzbot+9fe3b8d9f5c64ff410a7 at syzkaller.appspotmail.com
[4 lines not shown]
Merge tag 'sched_ext-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo:
- An error raised by a BPF program before the scheduler finished
enabling was consumed by the disable path's pre-enable shortcut,
leaving a running scheduler that couldn't be disabled and was later
freed while in use.
- Two compat kfuncs dereferenced a NULL scheduler when handed an exited
or idle task, oopsing the kernel.
- Keep-running decisions in the dispatch path used the root scheduler's
flags for tasks belonging to a sub-scheduler, causing warnings and
stalls.
- Schedulers with their own CPU ID mapping had no way to learn which
IDs are online. Add a kernel-maintained online mask to plug the hole.
[19 lines not shown]
Merge tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fix from Tejun Heo:
- The task iterator could pick up a dying task whose refcount had
already dropped to zero and resurrect it, leading to a use-after-free
when reading cgroup.procs. Skip such tasks.
* tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
cgroup: Avoid iteration of dying tasks with zero refcount
sched_ext: Maintain an online cid mask in the scheduler arena
Schedulers on the default cid mapping treat [0, nr_online_cids) as the
online set and restart on hotplug. Schedulers that install their own mapping
with scx_bpf_cid_override() have no way to learn which cids are online: the
count no longer identifies members and the CPU-form cpumask is unusable from
cid programs. This is an obvious hole in the cid API.
Add scx_bpf_online_cmask(), a kernel-maintained cmask in the scheduler's
arena, allocated alongside the per-CPU scratch masks and populated after the
cid mapping is finalized and before ops.init(), for child schedulers too.
The pointer stays valid through ops.exit() with no reference to take. It is
the arena offset as a void pointer, the same form struct_ops arena arguments
arrive in. The verifier types the void return as a scalar for the program's
arena cast.
The mask follows the SCX hotplug notifications: seeded from cpu_active_mask
and updated before ops.cid_online/offline() runs, so it lags cpu_online_mask
only inside a hotplug transition. Updates walk the scheduler list under the
[7 lines not shown]
sched_ext: scx_qmap: Restore unused idle claims from ops.dispatch()
scx_qmap tracks idle cids itself. pick_direct_dispatch_cid() claims a cid by
clearing its bit and the task is inserted into that cid's local DSQ, which
kicks the CPU. When the task does not arrive, for example because the insert
fell back to the global DSQ after an affinity change, the CPU wakes, finds
nothing and picks idle again. That is not an idle transition, so
ops.update_idle() is not called and the cid stays marked busy until an
unrelated task runs on it.
Restore the claim from ops.dispatch(). The kick guarantees a dispatch on the
kicked CPU, and when it finds nothing to run with a NULL @prev, the CPU is
going back to idle. Document the pattern in ops.update_idle(), which reports
only actual transitions.
Signed-off-by: Tejun Heo <tj at kernel.org>
Reviewed-by: Andrea Righi <arighi at nvidia.com>
Cc: Andrea Righi <arighi at nvidia.com>
Merge tag 'sysctl-7.03-fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl
Pull sysctl fixes from Joel Granados:
- Re-add the range check for millisecond to jiffy conversion in sysctl
They where removed in d174174c6776 ("sysctl: replace
SYSCTL_INT_CONV_CUSTOM macro with functions") and b96b5c6708ea
("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec")
- Fix type truncation in sysctl_msec_to_jiffies
Previously truncated millisecond values now get converted into
MAX_JIFFY_OFFSET
* tag 'sysctl-7.03-fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
sysctl: Fix type truncation in sysctl_msec_to_jiffies
sysctl: Check range in do_proc_ulong_conv_ms_jiffies
sysctl: Check range in proc_dointvec_ms_jiffies_minmax
sysctl: Check range in proc_dointvec_ms_jiffies_minmax
Add the range check to do_proc_int_conv_ms_jiffies_minmax that commit
d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with
functions") incorrectly removed.
Fixes: d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions")
Signed-off-by: Kuniyuki Iwashima <kuniyu at google.com>
Signed-off-by: Joel Granados <joel.granados at kernel.org>
