kernel/git/stable/linux.git/sound/usb/qcom, branch linux-7.2.y

ALSA: usb-audio: qcom: Free QMI handle

2026-06-25T11:56:21+00:00

qc_usb_audio_probe() allocates svc->uaudio_svc_hdl separately from the uaudio_qmi_svc object. qmi_handle_release() releases the resources owned by an initialized QMI handle, but does not free the memory containing the struct qmi_handle itself. The probe error path and the remove path currently release the handle and then free svc, losing the last pointer to the separately allocated handle. This leaks one struct qmi_handle on each affected probe unwind and on each successful probe/remove cycle. Free the handle after qmi_handle_release() in both paths. Signed-off-by: Xu Rao Link: https://patch.msgid.link/9108EC860F3F87DF+20260623071308.2549182-1-raoxu@uniontech.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: qcom: clear opened when stream enable fails

2026-06-18T10:44:59+00:00

On enable, subs->opened is set before the service_interval is validated; an invalid interval jumps to the response label without clearing it, so the substream is wedged at -EBUSY until a disable or disconnect. Clear subs->opened on the enable error path. Fixes: 326bbc348298a ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260618025126.1862954-3-michael.bommarito@gmail.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: qcom: reject stream disable with no active interface

2026-06-18T10:43:02+00:00

handle_uaudio_stream_req() resolves an interface index with info_idx_from_ifnum(), which returns -EINVAL when no interface matches. The enable branch and the response: cleanup label both guard against a negative index, but the disable branch does not: it forms info = &uadev[pcm_card_num].info[info_idx] and dereferences it. uadev[].info is a pointer allocated only when a stream is first enabled, so a negative info_idx on the disable path is unsafe in two ways: - If the card was never enabled, .info is NULL and &info[-EINVAL] is a wild pointer; reading info->data_ep_pipe faults (kernel oops). - If the card was enabled at least once (.info allocated) and the disable names an interface that does not match, &info[-EINVAL] points before the allocation; info->data_ep_pipe / info->sync_ep_pipe are an out-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte write (both pipe fields are cleared to 0). That is memory corruption, not just a NULL dereference. The request is reachable from unprivileged local userspace over AF_QIPCRTR. Reject a disable request with no resolved interface, matching the guard the enable path already has. Fixes: 326bbc348298a ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260618025126.1862954-2-michael.bommarito@gmail.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: qcom: Free sideband sg_table objects

2026-06-17T09:05:18+00:00

The Qualcomm USB audio offload driver obtains an endpoint transfer-ring table by calling xhci_sideband_get_endpoint_buffer(). This getter passes the endpoint ring to xhci_ring_to_sgtable(), which allocates the outer struct sg_table with kzalloc_obj(*sgt). The event-ring path is equivalent: xhci_sideband_get_event_buffer() also returns the result of xhci_ring_to_sgtable(). Inside xhci_ring_to_sgtable(), sg_alloc_table_from_pages() separately allocates the scatterlist storage referenced by sgt->sgl. The returned object therefore has two allocation layers: the outer struct sg_table and its internal scatterlist storage. The Qualcomm caller only invokes sg_free_table(sgt). sg_free_table() releases the scatterlist storage owned by the table, but it does not free the separately allocated outer struct sg_table. The local sgt pointer is then discarded, so every successful endpoint or event-ring query leaks the outer object. Call kfree(sgt) after sg_free_table(sgt) in both setup paths, after the required page and DMA addresses have been copied out. Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Signed-off-by: Xu Rao Link: https://patch.msgid.link/90B353283AA150C4+20260616115916.1222915-1-raoxu@uniontech.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: qcom: Guard sideband endpoint removal

2026-06-12T09:01:47+00:00

qmi_stop_session() conditionally looks up the cached data and sync endpoints, but removes each endpoint unconditionally. The data endpoint is always present for an active offload stream, while the sync endpoint is optional. When no sync endpoint exists, ep still refers to the data endpoint and the code attempts to remove that endpoint a second time. The current sideband implementation rejects the duplicate removal, but the teardown path should not pass an unrelated endpoint for an absent sync endpoint. Only look up and remove an endpoint when its cached pipe exists, check the lookup result, and clear the cached pipe after handling it. This matches the normal stream-disable path. Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260611-alsa-usb-qcom-guard-sideband-endpoint-removal-v1-1-00e73787c156@gmail.com Signed-off-by: Takashi Iwai

ALSA: usb-audio: qcom: Initialize offload control return value

2026-06-05T11:13:55+00:00

snd_usb_offload_create_ctl() returns ret after walking the USB PCM list, but ret is only assigned after a playback stream passes the endpoint and PCM-index filters. If all playback streams are skipped, for example because there is no playback endpoint or because all PCM indexes exceed the 0xff control range, the function returns an uninitialized stack value. Initialize ret to 0 so the no-control-created path returns deterministic success, while preserving the existing negative error return when snd_ctl_add() fails. Fixes: a67656f011d1 ("ALSA: usb-audio: qcom: Add USB offload route kcontrol") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260605-alsa-usb-qcom-offload-ret-init-v1-1-dc72fcc4bd3b@gmail.com Signed-off-by: Takashi Iwai

ALSA: usb: qcom: Drop unused variables

2026-06-04T15:26:04+00:00

Forgot to clean up the unused variables after the code refactoring, which leads to compile warnings. Reported-by: Mark Brown Closes: https://lore.kernel.org/aiGUoChmVKE-xwvC@sirena.org.uk Fixes: f1f16e1809c8 ("ALSA: usb-audio: qcom: Use PAGE_ALIGN macro for buffer size calculation") Link: https://patch.msgid.link/20260604151927.1227105-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: usb-audio: qcom: Use PAGE_ALIGN macro for buffer size calculation

2026-06-04T08:15:10+00:00

Use the kernel's PAGE_ALIGN() macro instead of open-coding the page alignment calculation. This improves code readability and follows kernel coding style. The manual calculation: mult = len / PAGE_SIZE; remainder = len % PAGE_SIZE; len = mult * PAGE_SIZE; len += remainder ? PAGE_SIZE : 0; is equivalent to: len = PAGE_ALIGN(len); Signed-off-by: wangdicheng Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260603091102.231370-4-wangdich9700@163.com

ALSA: usb-audio: qcom: Fix return value in qc_usb_audio_offload_fill_avail_pcms

2026-06-04T08:15:09+00:00

The function qc_usb_audio_offload_fill_avail_pcms() always returns -1 regardless of how many PCM devices were successfully filled. This makes it impossible for callers to know the actual number of available PCMs. Return the actual count of filled PCM devices instead, which allows callers to verify that all expected PCMs were properly enumerated. Signed-off-by: wangdicheng Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260603091102.231370-3-wangdich9700@163.com

ALSA: usb-audio: qcom: Use snprintf for mixer control name formatting

2026-06-04T08:15:09+00:00

The current code uses sprintf() to format control names without bounds checking, which could lead to buffer overflow if PCM index is large. Replace sprintf with snprintf to ensure buffer safety. The ctl_name buffer is 48 bytes, and the formatted string could exceed this with large PCM index values. Using snprintf with sizeof(ctl_name) prevents potential buffer overflow. Signed-off-by: wangdicheng Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260603091102.231370-2-wangdich9700@163.com