linux.git/sound/drivers, branch master

ALSA: aloop: Use the new helper for stop-count refcount

2026-06-11T07:34:09+00:00

Replace the open-code for managing the stop-count refcount with the
new helpers.
Only a code cleanup, no functional changes.

Signed-off-by: Takashi Iwai 
Link: https://patch.msgid.link/20260610154538.51076-5-tiwai@suse.de

ALSA: Improve style of pnp_device_id array terminators

2026-06-10T07:25:03+00:00

To match how device-id array terminators look like for other device
types drop `.id = ""` from it and let the compiler care for zeroing the
entry.

There are no changes in the compiled drivers, only the source looks
nicer.

Signed-off-by: Uwe Kleine-König (The Capable Hub) 
Link: https://patch.msgid.link/47ae32220446ec1869898cf5e4b75ec94c32dfdf.1781023479.git.u.kleine-koenig@baylibre.com
Signed-off-by: Takashi Iwai

ALSA: aloop: Drop superfluous break

2026-06-09T10:50:06+00:00

At converting the spinlock to guard(), a break statement was put in
the scoped_guard block in loopback_jiffies_timer_function(), but it's
obviously superfluous (although it's harmless).  Better to drop it for
avoiding confusion.

Fixes: 1ef2cb6b29c2 ("ALSA: aloop: Use guard() for spin locks")
Link: https://patch.msgid.link/20260609074907.726593-1-tiwai@suse.de
Signed-off-by: Takashi Iwai

ALSA: drivers: Mark some variables as __ro_after_init

2026-05-25T07:31:52+00:00

Some variables in the 'ALSA/drivers' are initialized only during the
init phase in the '__init' functions and never changed. So, mark them
as __ro_after_init to reduce the attack surface.

Signed-off-by: Len Bao 
Link: https://patch.msgid.link/20260524165249.48941-1-len.bao@gmx.us
Signed-off-by: Takashi Iwai

ALSA: pcmtest: Return -EFAULT on pattern read copy failure

2026-05-04T11:26:23+00:00

pattern_write() reports -EFAULT when copy_from_user() fails, but
pattern_read() converts copy_to_user() failures into a zero-length read.
That makes a userspace buffer fault look like EOF instead of reporting the
actual error.

Return -EFAULT from pattern_read() when copying the pattern data to
userspace fails, and update the file offset only after a successful copy.

Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
Signed-off-by: Cássio Gabriel 
Link: https://patch.msgid.link/20260501-alsa-pcmtest-pattern-read-efault-v1-1-53e1e8c11dda@gmail.com
Signed-off-by: Takashi Iwai

ALSA: aloop: Fix peer runtime UAF during format-change stop

2026-04-27T11:50:37+00:00

loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.

A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.

Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.

Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f
Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback")
Cc: stable@vger.kernel.org
Suggested-by: Takashi Iwai 
Signed-off-by: Cássio Gabriel 
Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com
Signed-off-by: Takashi Iwai

Revert "ALSA: pcmtest: fix reference leak on failed device registration"

2026-04-23T08:57:53+00:00

We'd like to address the problem rather in the error code path of
platform_device_register() itself instead of leaving it all callers,
since less than 1% of all callers of over 100
platform_device_register() do call platform_device_put() properly as
of now.

For making the work easier, revert the previous change commit
4ff036f95238 ("ALSA: pcmtest: fix reference leak on failed device
registration") again.

Link: https://lore.kernel.org/20260415193138.3861297-1-lgs201920130244@gmail.com
Link: https://patch.msgid.link/20260423075211.3977366-1-tiwai@suse.de
Signed-off-by: Takashi Iwai

ALSA: pcmtest: Fix resource leaks in module init error paths

2026-04-21T16:18:38+00:00

pcmtest allocates its pattern buffers and creates its debugfs tree
before registering the platform device and driver, but mod_init()
does not release those resources when a later init step fails.

As a result, a debugfs directory creation failure leaks the pattern
buffers, while platform_device_register() and
platform_driver_register() failures leave both the pattern buffers
and the debugfs tree behind. The recent fix for failed device
registration only dropped the embedded device reference.

Add the missing cleanup for the debugfs tree and pattern buffers in
the remaining module init error paths.

Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel 
Link: https://patch.msgid.link/20260421-alsa-pcmtest-init-unwind-v1-1-03fe0c423dbb@gmail.com
Signed-off-by: Takashi Iwai

ALSA: pcmtest: fix reference leak on failed device registration

2026-04-17T07:54:34+00:00

When platform_device_register() fails in mod_init(), the embedded struct
device in pcmtst_pdev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  mod_init()
    -> platform_device_register(&pcmtst_pdev)
       -> device_initialize(&pcmtst_pdev.dev)
       -> setup_pdev_dma_masks(&pcmtst_pdev)
       -> platform_device_add(&pcmtst_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li 
Link: https://patch.msgid.link/20260415193138.3861297-1-lgs201920130244@gmail.com
Signed-off-by: Takashi Iwai

ALSA: vx: use correct function name in kernel-doc comment

2026-04-17T07:48:20+00:00

Use the correct function name to avoid a kernel-doc warning (when
W=1 is used):

vx_cmd.h:210: warning: expecting prototype for vx_send_pipe_cmd_params().
 Prototype was for vx_set_pipe_cmd_params() instead

Signed-off-by: Randy Dunlap 
Signed-off-by: Takashi Iwai 
Link: https://patch.msgid.link/20260216060010.2784438-1-rdunlap@infradead.org