kernel/git/stable/linux.git/sound/drivers, branch master

Merge tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2026-08-19T17:04:59+00:00

Pull sound updates from Takashi Iwai: "It was a fairly busy development cycle - the changes spread over from the core side to leaf drivers, with lots of cleanups and enhancements. Here we go, some highlights: ALSA core: - Extension of ALSA control component list ABI - Locking optimization and RCU conversion of ALSA sequencer core - A few hardening fixes for UMP and sequencer core - Drop __bitwise and __force prefix from UAPI definitions ASoC: - Automatic DAI format selection code deployment across many drivers - Sorting of register default tables to prevent ordering issues in many drivers - Lots of code cleanups and refactoring - Updates in Qualcomm driver stack - New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek RT1321 VA1/2 and RT766/7 HD-audio: - Support for AW88399 HD-audio side codec for Lenovo Legion laptops - Support for Hygon and Lisuan HDMI controllers - Robustness fixes for wild device binding - Lots of quirks/fixups: Realtek and Conexant codecs for ASUS, Lenovo, Acer, etc USB-audio: - Support for Pioneer DJ DJM-S11 - Scarlett2/FCP private URB notification fixes - Extended quirk_flags to 64bit - Hardening fixes for 6fire, bcd2000, usx2y - Device-specific quirks for Mackie, Valeton, SPACETOUCH General: - Auto-cleanup for put_device() and firmware loading across multiple platforms" * tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits) ALSA: hda: Fix connection list comparison in proc output ALSA: docs: fix dead link to Intel HD-audio spec ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio ALSA: hda: Add Lisuan HDMI controller and codec support ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F) ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57 ASoC: tas2783-sdw: do not treat read-only Controls as writable ASoC: SOF: validate topology volume range before allocation ASoC: cs35l56: Use IRQ provided by the SoundWire core soundwire: bus_type: Create IRQ mapping before calling driver probe() ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq() ASoC: cs35l56: Request IRQ in cs35l56_common_probe() ALSA: core: Fix use-after-free in snd_card_do_free() ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper ASoC: dt-bindings: es8316: Fix supply property constraints ALSA: seq: midi: Serialize input teardown with event_input ...

ALSA: aloop: Drop __force casts

2026-08-13T14:43:27+00:00

Now that the bitwise parameter definitions are gone for PCM parameters, we don't have to cast with ugly __force prefix. Simply drop those superfluous casts. Reviewed-by: Cezary Rojewski Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260812060557.80445-8-tiwai@suse.de

ALSA: portman2x4: Check card index validity at probe

2026-08-06T16:10:21+00:00

Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260806153227.1460166-7-tiwai@suse.de

ALSA: mts64: Check card index validity at probe

2026-08-06T16:10:21+00:00

Although mts64 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260806153227.1460166-6-tiwai@suse.de

ALSA: virmidi: Check card index validity at probe

2026-08-06T16:10:21+00:00

virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260806153227.1460166-5-tiwai@suse.de

ALSA: serial-u16550: Check card index validity at probe

2026-08-06T16:10:21+00:00

serial-u16550 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260806153227.1460166-4-tiwai@suse.de

ALSA: mpu401: Check card index validity at probe

2026-08-06T16:10:21+00:00

mpu401 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260806153227.1460166-3-tiwai@suse.de

ALSA: aloop: Check card index validity at probe

2026-08-06T16:10:21+00:00

aloop driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260806153227.1460166-2-tiwai@suse.de

ALSA: dummy: Check card index validity at probe

2026-08-06T15:02:02+00:00

snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. Reported-by: syzbot+2fb5d1f7cc4c1f132bcc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a73bd4d.01d0871a.3a0d52.0005.GAE@google.com Cc: Link: https://patch.msgid.link/20260806100433.1287393-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: aloop: Fix spinlock deadlock in loopback_hrtimer_stop()

2026-08-03T06:54:44+00:00

In loopback_hrtimer_stop(), calling hrtimer_cancel() while holding cable->lock triggers an AB-BA spinlock deadlock if the hrtimer softirq is executing concurrently on another CPU: 1) CPU A runs loopback_trigger(STOP), acquires spin_lock(&cable->lock), and calls hrtimer_cancel(). Since hrtimer_cancel() is synchronous, it spins waiting for the executing callback to complete before returning. 2) CPU B executes loopback_hrtimer_function(), which immediately tries to acquire spin_lock(&cable->lock). This mutual dependency leads to a CPU hard lockup and NMI watchdog panic when multiple streams start and stop concurrently with small period sizes. Replace hrtimer_cancel() in loopback_hrtimer_stop() with the non-blocking hrtimer_try_to_cancel(), matching the behavior of jiffies timers (timer_delete vs timer_delete_sync). If try_to_cancel returns -1 because the handler is running, CPU A releases cable->lock cleanly. When the running handler subsequently acquires cable->lock, it observes that the stream is no longer in running state (cleared by trigger STOP) and terminates without re-arming the timer. Synchronous hrtimer_cancel() remains preserved in loopback_hrtimer_stop_sync() where cable->lock is not held. Fixes: bf08a5f698dc ("ALSA: aloop: Add 'hrtimer' option to timer_source") Signed-off-by: Yu-Hsuan Hsu Link: https://patch.msgid.link/20260731074255.1513402-1-yuhsuan@chromium.org Signed-off-by: Takashi Iwai