kernel/git/next/linux-next.git/sound, branch master

Merge branch 'togreg' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git

2026-07-14T13:23:21+00:00

Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git

2026-07-14T12:59:51+00:00

Merge branch 'for-mfd-next' of https://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git

2026-07-14T12:59:23+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git

2026-07-14T12:59:08+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git

2026-07-14T12:59:06+00:00

Merge branch 'for-linus' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git

2026-07-14T11:19:59+00:00

Merge remote-tracking branch 'asoc/for-7.3' into asoc-next

2026-07-14T10:21:13+00:00

ALSA: seq: close a re-opened queue timer in the destructor

2026-07-14T09:08:59+00:00

queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd_seq_timer_delete() frees q->timer. A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT that took a queueptr() use_lock reference before the queue was unlinked runs snd_seq_timer_open() after the close. Open refuses re-open only while timeri is set, and the close just cleared it, so it re-opens timeri. snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop() is a no-op, because running was cleared first. So it frees q->timer with the instance still live. The queue is freed next. The instance stays on the global timer with callback_data pointing at the freed queue. A non-owner START on the unlocked queue arms it. The next tick derefs the freed queue in snd_seq_timer_interrupt(). Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and no queue ownership required. Close any lingering instance in the destructor. There, ->timeri can no longer change: the queue is unlinked and all use_lock borrowers have drained, so no snd_seq_queue_use() can re-open it. Close it before clearing q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt() to finish, and that callback still reads q->timer (via snd_seq_check_queue()), so q->timer must stay valid until it drains. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei Link: https://patch.msgid.link/422FDB81-2A68-47C7-A22D-2D3301E2E86D@doyensec.com Signed-off-by: Takashi Iwai

Merge branch into tip/master: 'timers/core'

2026-07-14T09:03:50+00:00

# New commits in timers/core: f44ce7fdbdd0 ("selftests: timers: Partially revert "Remove local NSEC_PER_SEC and USEC_PER_SEC defines"") 794ddd6e15cf ("ntp: Remove tick_length_base, use tick_length directly") 34ce97c33dca ("timekeeping: Settle competing time_offset and time_adjust skew") 289d1759494f ("timekeeping: Drive time_adjust skew via per-tick ntp_error transfer") d375af589909 ("timekeeping: Drive time_offset skew via per-tick ntp_error transfer") 869a55e662a0 ("timekeeping: Account for clocksource tick quantisation via NTP") b7befd6d9120 ("timekeeping: Account for monotonicity adjustment in ntp_error") 79b8bd857bd7 ("MAINTAINERS: Add Miroslav as timekeeping reviewer") 79ced850e549 ("y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32") 79bd39c58f2c ("timekeeping: Move the vDSO update declarations into a private header") 6e435911394b ("timekeeping: Fold vdso_time_update_aux() declarations into the generic ifdeffery") faef65e45a2a ("hrtimer: Remove inclusion of hrtimer_bases.h remove from hrtimer.h") 0c31af3d23e6 ("x86/speculation: Explicitly include linux/types.h") 071993aac72e ("hrtimer: Explicitly include some necessary headers in hrtimer_rearm.h") 95cf8bbadd10 ("hrtimer: Explicitly include linux/hrtimer_bases.h") 73fcec09d162 ("tick: Explicitly include linux/hrtimer_bases.h") a116c7582d7f ("hrtimer: Move hrtimer_update_function() to hrtimer.c") d3dc7fabd4c4 ("hrtimer: Move hrtimer_callback_running() to hrtimer_bases.h") 03b5d4c27982 ("hrtimer: Rename hrtimer_defs.h to hrtimer_bases.h") c4415c993fc2 ("hrtimer: Don't take cpu_base::lock in hrtimer_get_next_event() when hres_active") 1d28a67d496f ("timer_list: Annotate print_cpu() diagnostic reads") 06aba58e5849 ("time/namespace: Validate nanosecond field in proc_timens_set_offset()") eddfded41965 ("timers/migration: Fix memory leak in tmigr_setup_groups() error path") f2eee7e31ccd ("timekeeping: Unwind aux clock sysfs children on failure") 3dee6537e728 ("clocksource: Unregister subsystem on device registration failure") b4b66151a714 ("selftests: timers: leap-a-day: Fix -w option and update usage comment") b3afded935a8 ("clocksource: Remove unused WATCHDOG_INTERVAL_NS macro") d8966ca88566 ("hrtimer: Remove unused next_timer argument from __hrtimer_reprogram()") e2904ddb14a4 ("timekeeping: Document monotonic raw timestamps in snapshots correctly") a73d7f98e41a ("posix-cpu-timers: Don't abuse lock_task_sighand() in handle_posix_cpu_timers()") 034b5779b85b ("hrtimer: Remove unused clock_base_next_timer_safe()") Signed-off-by: Ingo Molnar

ALSA: usb-audio: um144mkii: use "var" keyword for data

2026-07-14T06:00:44+00:00

Use the "var" keyword when describing data definitions to avoid kernel-doc warnings: Warning: sound/usb/usx2y/us144mkii_pcm.h:14 cannot understand function prototype: 'const struct snd_pcm_hardware tascam_pcm_hw;' Warning: sound/usb/usx2y/us144mkii_pcm.h:21 cannot understand function prototype: 'const struct snd_pcm_ops tascam_playback_ops;' Warning: sound/usb/usx2y/us144mkii_pcm.h:28 cannot understand function prototype: 'const struct snd_pcm_ops tascam_capture_ops;' Signed-off-by: Randy Dunlap Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260713180303.526409-5-rdunlap@infradead.org