This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>

The snd_dummy_capsrc_put() builds its change flag with &&, so it reports
a change only when both channels move at once.  Writing a single channel
stores the new value and returns 0, the control core then sends no
SNDRV_CTL_EVENT_MASK_VALUE, and a second reader keeps showing the old
setting until it polls again.

The volume put a few lines above compares the same pair of channels with
||.

The mixer selftest already reports this.  With snd-dummy loaded it fails
event_missing on all five capture switches:

  # CD Capture Switch.1 orig 0 read 1, is_volatile 0
  not ok 13 event_missing.Dummy.9

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260901153921.3971-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Pull sound fixes from Takashi Iwai:
 "A collection of various small fixes since the last PR. Most changes
  are device-specific fixes, while there are a few fixes addressing the
  issues reported recently by fuzzers.

  Here are highlights:

  ALSA Core:
   - Prevent adding invalid kcontrols to the LED layer
   - Workaround for a false-positive mutex lockdep warning in rawmidi

  USB-audio:
   - Relaxed the sticky mixer behavior check that caused regressions
   - Fix an OOB write in Novation MIDI output
   - Proper cleanup after system-resume errors
   - Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
     Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3

  HD-audio:
   - Conexant headset plugin fixes
   - Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
     TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9

  ASoC:
   - DAPM: Fix off-by-one check on the second enum channel
   - Tegra: Fix and sort register defaults
   - AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
     HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
   - Fixes Qualcomm TDM handling
   - Fix double put_device() on SoundWire
   - Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926

  Misc:
   - Fix card leak on probe error on ice1712 driver
   - Hardening for legacy aoa, mtpav and pcxhr drivers"

* tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
  ALSA: control: Don't add invalid kcontrols to LED layer
  ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
  ALSA: hda/conexant: Always enable the headset-mic pin on plugin
  ASoC: dapm: Fix off-by-one check on the second enum channel
  ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16
  ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk
  ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk
  ASoC: soc-generic-dmaengine: Fix DMA channel request warning
  ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning
  ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD
  ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
  ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt
  ALSA: usb-audio: Complete cleanup after system-resume errors
  ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
  ALSA: aoa: i2sbus: Check IRQ before requesting it
  ALSA: usb-audio: Skip mixer creation on M-Audio Venom
  ALSA: usb-audio: Skip reading sample rate on M-Audio Venom
  ASoC: rt766: add RT766/RT767 VA1 device IDs
  ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
  ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
  ...

snd_mtpav_output_timer() rearms chip->timer while holding
chip->spinlock and accesses the card-private mtpav state.

snd_mtpav_free() currently takes the same lock and calls
timer_delete() when the timer is active. This only removes a
pending timer; it does not wait for a callback that is already
running and does not prevent the callback from rearming the timer.

A callback running on another CPU can therefore continue after
snd_mtpav_free() releases the lock and access the card-private
state while the card is being torn down. It can also rearm the
timer after timer_delete() has returned.

Call timer_shutdown_sync() without holding chip->spinlock. This
waits for any running callback to finish and prevents further
rearming before the card-private mtpav state is released.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260820112749.9195-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Pull sound updates from Takashi Iwai:
 "It was a fairly busy development cycle - the changes spread over from
  the core side to leaf drivers, with lots of cleanups and enhancements.
  Here we go, some highlights:

  ALSA core:
   - Extension of ALSA control component list ABI
   - Locking optimization and RCU conversion of ALSA sequencer core
   - A few hardening fixes for UMP and sequencer core
   - Drop __bitwise and __force prefix from UAPI definitions

  ASoC:
   - Automatic DAI format selection code deployment across many drivers
   - Sorting of register default tables to prevent ordering issues in
     many drivers
   - Lots of code cleanups and refactoring
   - Updates in Qualcomm driver stack
   - New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson
     2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek
     RT1321 VA1/2 and RT766/7

  HD-audio:
   - Support for AW88399 HD-audio side codec for Lenovo Legion laptops
   - Support for Hygon and Lisuan HDMI controllers
   - Robustness fixes for wild device binding
   - Lots of quirks/fixups: Realtek and Conexant codecs for ASUS,
     Lenovo, Acer, etc

  USB-audio:
   - Support for Pioneer DJ DJM-S11
   - Scarlett2/FCP private URB notification fixes
   - Extended quirk_flags to 64bit
   - Hardening fixes for 6fire, bcd2000, usx2y
   - Device-specific quirks for Mackie, Valeton, SPACETOUCH

  General:
   - Auto-cleanup for put_device() and firmware loading across multiple
     platforms"

* tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits)
  ALSA: hda: Fix connection list comparison in proc output
  ALSA: docs: fix dead link to Intel HD-audio spec
  ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio
  ALSA: hda: Add Lisuan HDMI controller and codec support
  ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
  ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries
  ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F)
  ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57
  ASoC: tas2783-sdw: do not treat read-only Controls as writable
  ASoC: SOF: validate topology volume range before allocation
  ASoC: cs35l56: Use IRQ provided by the SoundWire core
  soundwire: bus_type: Create IRQ mapping before calling driver probe()
  ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq()
  ASoC: cs35l56: Request IRQ in cs35l56_common_probe()
  ALSA: core: Fix use-after-free in snd_card_do_free()
  ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df
  ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control
  ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper
  ASoC: dt-bindings: es8316: Fix supply property constraints
  ALSA: seq: midi: Serialize input teardown with event_input
  ...

Now that the bitwise parameter definitions are gone for PCM
parameters, we don't have to cast with ugly __force prefix.
Simply drop those superfluous casts.

Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260812060557.80445-8-tiwai@suse.de

Although portman2x4 driver has a check of the given devptr->id value,
it doesn't check for a negative id, which is often given as "none" or
such value when bound via sysfs.  This may lead to OOB access for
index[] and other parameters.

Add a sanity check for the card index and warn/correct it if it's a
value out of the range.

Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-7-tiwai@suse.de

Although mts64 driver has a check of the given devptr->id value, it
doesn't check for a negative id, which is often given as "none" or
such value when bound via sysfs.  This may lead to OOB access for
index[] and other parameters.

Add a sanity check for the card index and warn/correct it if it's a
value out of the range.

Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-6-tiwai@suse.de

virmidi driver blindly trusts that the given devptr->id value is
within the proper card index range at probe.  It's OK for the devices
the driver itself creates at the module probe time, but if the device
is bound manually via sysfs interface, this could be -1 as "none", and
this leads to OOB access for index[] and other parameters.

Add a sanity check for the card index and warn/correct it if it's a
value out of the range.

Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-5-tiwai@suse.de

serial-u16550 driver blindly trusts that the given devptr->id value is
within the proper card index range at probe.  It's OK for the devices
the driver itself creates at the module probe time, but if the device
is bound manually via sysfs interface, this could be -1 as "none", and
this leads to OOB access for index[] and other parameters.

Add a sanity check for the card index and warn/correct it if it's a
value out of the range.

Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260806153227.1460166-4-tiwai@suse.de