summaryrefslogtreecommitdiff
path: root/sound/usb
AgeCommit message (Collapse)Author
3 daysALSA: usb-audio: add clock quirk for Motu 1248Nicola Lunghi
The Motu 1248 (and probably other older Motu AVB interfaces) take more than 2 seconds to switch clock. During the clock switching process the device return that the clock is not valid. This is similar to what already implemented for the Microbook II interface. Add the Motu 1248 usb id to the existing Motu quirk. Signed-off-by: Nicola Lunghi <nick83ola@gmail.com> Link: https://patch.msgid.link/20260504144520.699522-2-nick83ola@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
3 daysALSA: usb-audio: midi2: Restart output URBs on resumeCássio Gabriel
USB MIDI 2.0 suspend saves the endpoint running state, clears it and kills all endpoint URBs. Resume restores the running state, but only restarts input endpoints. For a running output endpoint, this leaves the endpoint marked running with an empty URB queue. Output transfer progress depends on either the rawmidi trigger path starting the queue or an output completion refilling it. After suspend there is no completion left, and output data that remains queued in the raw UMP or legacy rawmidi buffer can stay stalled until userspace happens to trigger the stream again. Restore the saved state with atomic accessors, keep input endpoints restarted as before, and restart output endpoints that were running before suspend. Clear the saved suspend state after restoring it. Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260504-usb-midi2-output-resume-v1-1-c089cc8ad3c6@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
3 daysALSA: usb-audio: Add quirk flags for JBL PebblesRong Zhang
JBL Pebbles is a pair of desktop speakers with UAC interface. Its Playback and Capture mixers use linear volume with val = 0/999/1 and 0/3996/4. Meanwhile, the reported sample rates are truncated to multiples of 0x100 (i.e., 44100 => 44032), resulting in noisy kmsg, as a warning message is printed each time a stream is opened. Add a quirk table entry matching VID/PID=0x05fc/0x0231 and applying linear volume and sample rate quirk flags, so that it can work properly. Also note that the volume control knob on device is an incremental encoder. It does nothing but sends KEY_VOLUMEUP and KEY_VOLUMEDOWN per rotation, controlling the UAC Playback volume mixer indirectly. Hence, the linear volume quirk flags also enable the volume control knob to function properly. Quirky device sample: usb 5-1.1: new full-speed USB device number 12 using xhci_hcd usb 5-1.1: New USB device found, idVendor=05fc, idProduct=0231, bcdDevice= 1.00 usb 5-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 5-1.1: Product: JBL Pebbles usb 5-1.1: Manufacturer: Harman International Industries usb 5-1.1: SerialNumber: 1.0.0 usb-storage 5-1.1:1.0: USB Mass Storage device detected scsi host0: usb-storage 5-1.1:1.0 usb 5-1.1: Found last interface = 1 usb 5-1.1: 2:1: add audio endpoint 0x5 usb 5-1.1: Creating new data endpoint #5 usb 5-1.1: 2:1 Set sample rate 44100, clock 0 usb 5-1.1: current rate 44032 is different from the runtime rate 44100 usb 5-1.1: 3:1: add audio endpoint 0x84 usb 5-1.1: Creating new data endpoint #84 usb 5-1.1: 3:1 Set sample rate 44100, clock 0 usb 5-1.1: current rate 44032 is different from the runtime rate 44100 usb 5-1.1: [2] FU [PCM Playback Switch] ch = 1, val = 0/1/1 usb 5-1.1: Warning! Unlikely big volume step count (=999), linear volume or wrong cval->res? usb 5-1.1: [2] FU [PCM Playback Volume] ch = 2, val = 0/999/1 usb 5-1.1: [5] FU [Mic Capture Switch] ch = 1, val = 0/1/1 usb 5-1.1: Warning! Unlikely big volume step count (=999), linear volume or wrong cval->res? usb 5-1.1: [5] FU [Mic Capture Volume] ch = 2, val = 0/3996/4 input: Harman International Industries JBL Pebbles as /devices/pci0000:00/0000:00:08.3/0000:67:00.3/usb5/5-1/5-1.1/5-1.1:1.4/0003:05FC:0231.0018/input/input55 hid-generic 0003:05FC:0231.0018: input,hidraw2: USB HID v2.01 Device [Harman International Industries JBL Pebbles] on usb-0000:67:00.3-1.1/input4 Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260504-uac-jbl-pebbles-v1-1-c888d592a286@rong.moe Signed-off-by: Takashi Iwai <tiwai@suse.de>
3 daysALSA: usb-audio: Add quirk flags for AlphaTheta EUPHONIAAnton Swart
The AlphaTheta EUPHONIA (VID 0x2b73, PID 0x0047) is a USB Audio Class 2 DJ mixer that requires implicit feedback for full-duplex operation. The capture endpoint (0x83 IN, interface 2) acts as the implicit feedback source for the playback endpoint (0x03 OUT, interface 1), and the device firmware does not send isochronous data on the capture endpoint unless the host is simultaneously sending data on the playback endpoint, i.e. playback must be started first. Without QUIRK_FLAG_PLAYBACK_FIRST the kernel waits for capture URBs before submitting playback URBs, creating a deadlock: the device waits for playback data and the host waits for capture data. Without QUIRK_FLAG_GENERIC_IMPLICIT_FB the kernel does not detect the implicit feedback relationship between the two interfaces. The same flag combination is already used for the Behringer UMC202HD, UMC204HD and UMC404HD (0x1397:0x0507/0x0508/0x0509), which exhibit the identical implicit-feedback topology. Tested on Raspberry Pi 5 with kernel 6.12.75; continuous full-duplex streaming at 96 kHz / 24-bit, zero XRUNs. Signed-off-by: Anton Swart <anton.swart.jhb@gmail.com> Link: https://patch.msgid.link/20260503211517.14332-1-anton.swart.jhb@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
7 daysALSA: usb-audio: add min_mute quirk for Razer Nommo V2 XPauli Virtanen
ID 1532:055e Razer USA, Ltd Razer Nommo V2 X is tested to have muted min playback volume. Apply quirk for that. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/work_items/5235 Signed-off-by: Pauli Virtanen <pav@iki.fi> Link: https://patch.msgid.link/94449577332d14d7974864903825f27e5824ddbc.1777579951.git.pav@iki.fi Signed-off-by: Takashi Iwai <tiwai@suse.de>
9 daysALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USBAbhinav Mahadevan
The quirk entry for PreSonus AudioBox USB was mistakenly placed inside a disabled #if 0 block. Move it to the correct position after the Fixes: 34fe4a9df247 ("ALSA: usb-audio: Add quirk for PreSonus AudioBox USB") Signed-off-by: Abhinav Mahadevan <abhi220204@gmail.com> Link: https://patch.msgid.link/20260428155117.5170-1-abhi220204@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
10 daysALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()Takashi Iwai
The convert_chmap_v3() has a loop with its increment size of cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, which may lead to potential endless loop by a malformed descriptor. Add a proper size check to abort the loop for plugging the hole. Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors") Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260427152224.15276-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
10 daysALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streamsTakashi Iwai
At parsing UAC3 streams, we allocate a PD object at each time, and either assign or free it. But there is a case where the PD object may be leaked; namely, in __snd_usb_parse_audio_interface() loop, when an audioformat shares the same endpoint with others, it's put to a link and returns from snd_usb_add_audio_stream(), but the PD is forgotten afterwards. Overall, the treatment of PD object in the parser code is a bit flaky, and we should be more careful about the object ownership. This patch tries to fix the above case and improve the code a bit. The pd object is now managed with the auto-cleanup in the loop, and the ownership is updated when the pd object gets assigned to the stream, which guarantees the release of the leftover object. Fixes: 7edf3b5e6a45 ("ALSA: usb-audio: AudioStreaming Power Domain parsing") Link: https://patch.msgid.link/20260427151508.12544-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
10 daysALSA: caiaq: Don't abort when no input device is availableTakashi Iwai
The previous fix to handle the error from setup_card() caused a regression for the models that have no dedicated input device; snd_usb_caiaq_input_init() just returns -EINVAL, and we treat it as a fatal error although it should be ignored. As a regression fix, change the error code to -ENODEV, and ignore this error in the callee, to continue probing. Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly") Cc: <stable@vger.kernel.org> Link: https://bugzilla.kernel.org/show_bug.cgi?id=221423 Link: https://patch.msgid.link/20260427145642.6637-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
10 daysALSA: caiaq: Fix potentially leftover ep1_in_urb at error pathTakashi Iwai
The previous fix for handling the error from setup_card() missed that an internal URB cdev->ep1_in_urb might have been already submitted beforehand. In the normal case, this URB gets killed at the disconnection, but in the error path, we didn't do it, hence there can be a potential leak. Fix it in the error path for setup_card(), too. Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly") Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260427123819.890185-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
11 daysALSA: caiaq: fix usb_dev refcount leak on probe failureDeepanshu Kartikey
create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor. However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout). When any of those fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free is still NULL, card_free() never runs, the usb_get_dev() reference is not dropped, and the struct usb_device leaks along with its descriptor allocations and device_private. syzbot reproduces this with a malformed UAC3 device whose only valid altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call fails with -EIO and triggers the leak. Move the ->private_free assignment into create_card(), immediately after usb_get_dev(), so that every error path reaching snd_card_free() balances the reference. card_free()'s callees (snd_usb_caiaq_input_free, free_urbs, kfree) already tolerate the partially-initialized state because the chip private area is zero-initialized by snd_card_new(). Fixes: 80bb50e2d459 ("ALSA: caiaq: take a reference on the USB device in create_card()") Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2afd7e71155c7e241560 Tested-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Link: https://patch.msgid.link/20260426001934.70813-1-kartikey406@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
11 dayssound: ua101: fix division by zero at probeSeungJu Cheon
Add a missing sanity check for bNrChannels in detect_usb_format() to prevent a division by zero in playback_urb_complete() and capture_urb_complete(). USB core does not validate class-specific descriptor fields such as bNrChannels, so drivers must verify them before use. If a device provides bNrChannels = 0, frame_bytes becomes zero and is later used as a divisor in the URB completion handlers, leading to a kernel crash. Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support") Cc: stable@vger.kernel.org Signed-off-by: SeungJu Cheon <suunj1331@gmail.com> Link: https://patch.msgid.link/20260426111239.103296-1-suunj1331@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
11 daysALSA: usb-audio: apply quirk for Playstation PDP RiffmasterRosalie Wanders
This device, just like the Playstation 5's DualSense, has a volume that's too low, hid-playstation solves this by raising the minimum volume on the device itself by sending an output report, third party PS5 controllers/accessories do not support this output report format, so we apply a quirk to raise the minimum volume by 6dB. Signed-off-by: Rosalie Wanders <rosalie@mailbox.org> Link: https://patch.msgid.link/20260426025520.3985-2-rosalie@mailbox.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
11 daysALSA: usb-audio: Fix UAC3 cluster descriptor size checkCássio Gabriel
The UAC3 cluster descriptor length check in snd_usb_get_audioformat_uac3()was added to make sure that the buffer is large enough for a struct uac3_cluster_header_descriptor before the returned data is cast and used. However, the check uses sizeof(cluster), where cluster is a pointer, not the size of the descriptor header. This makes the validation depend on the architecture pointer size and does not match the intended object size. Check against sizeof(*cluster) instead. Fixes: fb4e2a6e8f28 ("ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260424-alsa-usb-uac3-cluster-size-v1-1-99a5808898a3@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-22ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switchCássio Gabriel
snd_microii_spdif_switch_put() returns 0 when the requested vendor register value differs from the cached one. This comparison was inverted by the resume-support conversion, so real SPDIF switch toggles are ignored while no-op writes still issue SET_CUR and report success. Return early only when the requested value matches the cached one. Fixes: 288673beae6c ("ALSA: usb-audio: Add resume support for MicroII SPDIF ctls") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260421-microii-spdif-switch-fix-v1-1-5c50dc28b88f@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-22ALSA: usb-audio: Avoid false E-MU sample-rate notificationsCássio Gabriel
snd_emuusb_set_samplerate() unconditionally notifies the E-MU SampleRate Extension Unit control after issuing SET_CUR. If snd_usb_mixer_set_ctl_value() fails, the control value has not changed, yet snd_usb_mixer_notify_id() still invalidates the cache and emits a value-change event to userspace. Notify the control only after a successful write. Fixes: 7d2b451e65d2 ("ALSA: usb-audio - Added functionality for E-mu 0404USB/0202USB/TrackerPre") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260421-alsa-emuusb-samplerate-notify-v1-1-8b63bbc1d7f1@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-21ALSA: usb-audio/line6: Add support for POD HD PROPhil Willoughby
The POD HD PRO is the rackmount version of the POD 500, with most of the same behaviors. As with some of the other rackmount POD devices it will not send captured audio to the host unless the host is sending playback audio, so it has LINE6_CAP_IN_NEEDS_OUT in addition to the POD 500 flags. Tested-By: Phil Willoughby <willerz@gmail.com> Signed-off-by: Phil Willoughby <willerz@gmail.com> Link: https://patch.msgid.link/20260420152405.7230-1-willerz@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-20Revert "ALSA: usb-audio: Add quirk for SmartlinkTechnology M01"Takashi Iwai
This reverts commit d1aa2b9aad696c0434a5e0ac1d07810ce264e686. Juan reported that the patch didn't work as expected at the later check, failing to create PCM capture devices that has worked beforehand. Drop the change again for addressing the regression, and we'll continue developing a proper fix later. Reported-by: Juan Pablo Fuentealba Bizama <jpfuentealbabizama@gmail.com> Closes: https://lore.kernel.org/20260417150748.6684-1-jpfuentealbabizama@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17ALSA: caiaq: Fix control_put() result and cache rollbackCássio Gabriel
control_put() always returns 1 and updates cdev->control_state[] before sending the USB command. It also ignores transport errors from usb_bulk_msg(), snd_usb_caiaq_send_command(), and snd_usb_caiaq_send_command_bank(). That breaks the ALSA .put() contract and can leave control_get() reporting a cached value the device never accepted. Return 0 for unchanged values, propagate transport failures, and restore the cached byte when the write fails. Fixes: 8e3cd08ed8e59 ("[ALSA] caiaq - add control API and more input features") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260417-caiaq-control-put-v1-1-c37826e92447@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17ALSA: 6fire: Fix input volume change detectionCássio Gabriel
usb6fire_control_input_vol_put() stores the analog capture volume as a signed offset in rt->input_vol[] (-15..+15), but it compares the cached value against the user-visible mixer value (0..30) before subtracting 15. This mixes two domains in the change detection path. Since the runtime is zero-initialized, the visible default is 15; writing 0 right after probe is ignored, while writing 15 is reported as a change even though the cached value remains 0. Normalize the user value before comparing it with the cached offset. Fixes: 06bb4e743501 ("ALSA: snd-usb-6fire: add analog input volume control") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260416-alsa-6fire-input-volume-change-detection-v1-1-ec78299168df@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17ALSA: usb-audio: Add quirk entries for NexiGo N930W webcamJohnathan Penberthy
The NexiGo N930W 60fps webcam (USB ID 3443:930d) hits the same 'cannot get freq at ep 0x84' error in snd-usb-audio as its sibling N930AF (1bcf:2283). Without QUIRK_FLAG_GET_SAMPLE_RATE the ADC clock is never configured and the microphone streams only zero samples. Testing on Linux 6.17 with QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16 (via quirk_alias=3443930d:1bcf2283) confirmed the microphone captures real audio after a cold USB re-enumeration. Adding a native quirk_flags_table entry avoids the alias workaround. Signed-off-by: Johnathan Penberthy <johnathan.penberthy@gmail.com> Link: https://patch.msgid.link/20260417010123.3080904-1-johnathan.penberthy@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17ALSA: usb-audio: Add quirk for SmartlinkTechnology M01Juan Pablo Fuentealba Bizama
Add quirk entry for SmartlinkTechnology M01 USB microphone to enable the standard mixer interface. Signed-off-by: Juan Pablo Fuentealba Bizama <jpfuentealbabizama@gmail.com> Link: https://patch.msgid.link/20260416191149.12088-1-jpfuentealbabizama@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-16ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATESCássio Gabriel
parse_uac2_sample_rate_range() caps the number of enumerated rates at MAX_NR_RATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional triplets continues parsing the remaining triplets and repeatedly prints "invalid uac2 rates" while probe still holds register_mutex. Stop the whole parse once the cap is reached and return the number of rates collected so far. Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()") Cc: stable@vger.kernel.org Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820 Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-15ALSA: usb-audio: Tidy up error check for processing unitRong Zhang
There are two duplicated code paths calling get_min_max() with the same arguments in build_audio_procunit(). This once led to a failure to notice a code path that caused the `err' variable uninitialized when adding error checks for callers of get_min_max*() [1]. Move cases in the switch-case statement to tidy up the error check by merging the duplicated code paths together with a fallthrough attribute. This also eliminates the `err = 0' lines and aggregates the error check along with the corresponding call together, so that the intent of these code paths is clearer. The refactor also has an interesting effect that shrinks the .text size by 16 bytes (GCC 15 amd64). It seems that the compiler was unable to perform dead code elimination for the `err = 0' paths before. Link: https://lore.kernel.org/r/ad36dGpCBTGsyFr_@stanley.mountain/ [1] Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260414-uac-build_auto_procunit-refactor-v1-1-afeb7efa6518@rong.moe Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-15ALSA: 6fire: Drop unnecessary NULL checksTakashi Iwai
The NULL checks of chip pointer in usb6fire_chip_abrt() and usb6fire_card_free() are utterly useless, as it's guaranteed to be non-NULL. Drop them for increasing the readability. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260414132218.411013-5-tiwai@suse.de
2026-04-15ALSA: 6fire: Reduce multi-level conditionals in usb6fire_chip_disconnect()Takashi Iwai
The current code has deep indentation levels because of multiple if's. Make it returning and reduce the multi-level conditionals for increasing the code readability. No functional change, just but a code refactoring. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260414132218.411013-4-tiwai@suse.de
2026-04-15ALSA: 6fire: Fix leftover global pointers after probe failuresTakashi Iwai
snd-usb-6fire driver holds devices[] and chips[] pointer arrays to keep the usb_device and sfire_chip objects assigned to multiple interfaces. Those are, however, not properly cleared at the error path of usb6fire_chip_probe(), which may confuse the later probes. Also, the use of two pointer arrays makes things complicated; chips[] may be NULL while devices[] may be left over. For addressing this inconsistency, unify the pointer arrays, and use only chips[] for managing the multiple devices, while the device is checked with chip->dev pointer, instead. Also, the assignment of chips[] is moved at a later point where the probe successfully returns, so that we don't leave the pointer there after the error. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260414132218.411013-3-tiwai@suse.de
2026-04-15ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutexTakashi Iwai
In 6fire driver, we protect the concurrent calls against probe and disconnect with the register_mutex, but it's applied only partially. Since we handle two global pointers in devices[] and chips[] pairs, the assignment of the latter can be inconsistent upon concurrent interface probes, and the refcount handling isn't properly protected at disconnect, either. This patch extends the mutex application range to the whole probe and disconnect functions. It makes the code safer against potential concurrent probles and disconnects, while it makes the code easier to read, too. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260414132218.411013-2-tiwai@suse.de
2026-04-15ALSA: caiaq: Handle probe errors properlyTakashi Iwai
The probe procedure of setup_card() in caiaq driver doesn't treat the error cases gracefully, e.g. the error from snd_card_register() calls snd_card_free() but continues. This would lead to a UAF for the further calls like snd_usb_caiaq_control_init(), as Berk suggested in another patch in the link below. However, the problem is not only that; in general, this function drops the all error handlings (as it's a void function) although its caller can propagate an error to snd_probe(), which eventually calls snd_card_free() as a proper error path. That said, we should treat each error case in setup_card(), and just return the error code promptly, which is then handled later as a fatal error in snd_probe(). This patch achieves it by changing the setup_card() to return an error code. Also, the superfluous snd_card_free() call is removed, too. Note that card->private_free can be set still safely at returning an error. All called functions in card_free() have checks of the unassigned resources or NULL checks. Fixes: 8e3cd08ed8e5 ("[ALSA] caiaq - add control API and more input features") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20260413034941.1131465-2-berkcgoksel@gmail.com Link: https://patch.msgid.link/20260414105916.364073-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-14ALSA: usb-audio: Fix missing error handling for get_min_max*()Takashi Iwai
The recent fix to add the error return value check from get_min_max*() missed one case in build_audio_procunit() where no error value is set. This may lead to an uninitialized variable and confuse the caller (although this wouldn't happen practically because err is set for the loop of num_ins at the beginning of the funciton). Fix it by setting "err = 0" properly at the missing case, too. Fixes: 4f55a85cd4fc ("ALSA: usb-audio: Add error checks against get_min_max*()") Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/ad36dGpCBTGsyFr_@stanley.mountain Link: https://patch.msgid.link/20260414093336.305464-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-13ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUPGeoffrey D. Bennett
Same issue as the other 1st Gen Scarletts: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on the Scarlett 18i20 1st Gen (1235:800c). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: tucktuckg00se [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett <g@b4.vu> Link: https://patch.msgid.link/ad0ozNnkcFrcjVQz@m.b4.vu Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-13Merge tag 'asoc-v7.1' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v7.1 There's one new core feature here but mostly this has been a fairly quiet release, we've got a few new drivers and one core feature that's likely to be relatively rarely used but the bulk of the work this time around has been on quality. - Support for bus keepers, this will be used by the Apple device support. - Enhancements to the SDCA support, incuding retaskable jacks. - Unwinding of the pcm_new()/pcm_free() cleanups from Morimoto-san. - Test improvements for the Cirrus Logic drivers. - Large sets of fixes for the NXP, nVidia and Qualcomm drivers. - Support for AMD RPL DMICs, Cirrus Logic CS42L43 and CS47L47, nVidia machines with CPCAP and WM8962.
2026-04-13ALSA: caiaq: take a reference on the USB device in create_card()Berk Cem Goksel
The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call. Fixes: b04dcbb7f7b1 ("ALSA: caiaq: Use snd_card_free_when_closed() at disconnection") Cc: stable@vger.kernel.org Cc: Andrey Konovalov <andreyknvl@gmail.com> Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com> Link: https://patch.msgid.link/20260413034941.1131465-3-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-13Merge branch 'for-next' into for-linusTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-11ALSA: usb-audio: Do not expose sticky mixersRong Zhang
Some devices' mixers are sticky, which accept SET_CUR but do absolutely nothing. Registering these mixers confuses userspace and results in ineffective volume control. Check if a mixer is sticky by setting the volume to the maximum or minimum value and checking for effectiveness afterward. Prevent the mixer from being registered if it turns out to be sticky. Quirky device sample: usb 7-1: New USB device found, idVendor=0e0b, idProduct=fa01, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: Feaulle Rainbow usb 7-1: Manufacturer: Generic usb 7-1: SerialNumber: 20210726905926 (Mic Capture Volume) Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-3-29d62717befd@rong.moe Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-11ALSA: usb-audio: Move volume control resolution check into a functionRong Zhang
get_min_max_with_quirks() is too lengthy and hard to read. Move the volume control resolution check code into a function as it's relatively self-contained. Suggested-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/87o6jsk3vs.wl-tiwai@suse.de Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-2-29d62717befd@rong.moe Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-11ALSA: usb-audio: Add error checks against get_min_max*()Rong Zhang
All callers of get_min_max*() ignore the latter's return code completely. This means to ignore temporary errors at the probe time. However, it is not optimal and leads to some maintenance burdens. Return -EAGAIN for temporary errors, and check against it in the callers of get_min_max*(). If any other error occurs, bail out of the caller early. Suggested-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/87ldewi4j8.wl-tiwai@suse.de Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-1-29d62717befd@rong.moe Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-10ALSA: usb-audio: Add quirk for PreSonus AudioBox USBAbhinav Mahadevan
The PreSonus AudioBox USB (0x194f:0x0301) only supports S24_3LE format for both playback and capture. It does not support S16_LE despite being a USB full-speed device. Add explicit format quirks for both the playback (interface 2) and capture (interface 3) interfaces to ensure correct format negotiation. Signed-off-by: Abhinav Mahadevan <abhi220204@gmail.com> Link: https://patch.msgid.link/20260410143335.5974-1-abhi220204@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-10ALSA: usb-audio: Evaluate packsize caps at the right placeTakashi Iwai
We introduced the upper bound checks of the packet sizes by the ep->maxframesize for avoiding the URB submission errors. However, the check was applied at an incorrect place in the function snd_usb_endpoint_set_params() where ep->maxframesize isn't defined yet; the value is defined at a bit later position. So this ended up with a failure at the first run while the second run works. For fixing it, move the check at the correct place, right after the calculation of ep->maxframesize in the same function. Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations") Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292 Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-10ALSA: 6fire: fix use-after-free on disconnectBerk Cem Goksel
In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed. Fixes: a0810c3d6dd2 ("ALSA: 6fire: Release resources at card release") Cc: stable@vger.kernel.org Cc: Andrey Konovalov <andreyknvl@gmail.com> Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com> Link: https://patch.msgid.link/20260410051341.1069716-1-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-10ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0Greg Kroah-Hartman
A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to assign interface numbers sequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will then be dereferenced directly. Fix this up by checking the return value properly. Cc: Jaroslav Kysela <perex@perex.cz> Cc: Takashi Iwai <tiwai@suse.com> Fixes: dee1bcf28a3d ("ALSA: usb-audio: Add initial driver for TASCAM US-144MKII") Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026040955-fall-gaining-e338@gregkh Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-09ALSA: usb-audio: Add quirk flags for Feaulle RainbowRong Zhang
Feaulle Rainbow is a wired USB-C dynamic in-ear monitor (IEM) featuring active noise cancellation (ANC). The supported sample rates are 48000Hz and 96000Hz at 16bit or 24bit, but it does not support reading the current sample rate and results in an error message printed to kmsg. Set QUIRK_FLAG_GET_SAMPLE_RATE to skip the sample rate check. Its playback mixer reports val = -15360/0/128. Setting -15360 (-60dB) mutes the playback, so QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE is needed. Add a quirk table entry matching VID/PID=0x0e0b/0xfa01 and applying the mentioned quirk flags, so that it can work properly. Quirky device sample: usb 7-1: New USB device found, idVendor=0e0b, idProduct=fa01, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: Feaulle Rainbow usb 7-1: Manufacturer: Generic usb 7-1: SerialNumber: 20210726905926 Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260409-feaulle-rainbow-v1-1-09179e09000d@rong.moe Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-09ALSA: usb-audio: Add iface reset and delay quirk for HUAWEI USB-C HEADSETLianqin Hu
Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=12d1, idProduct=3a07 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: HUAWEI USB-C HEADSET usb 1-1: Manufacturer: bestechnic usb 1-1: SerialNumber: 0296C100000000000000000000000 Signed-off-by: Lianqin Hu <hulianqin@vivo.com> Link: https://patch.msgid.link/TYUPR06MB62176A18EA7A9DD0AC2826BCD2582@TYUPR06MB6217.apcprd06.prod.outlook.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-09Merge branch 'for-linus' into for-nextTakashi Iwai
Pull 7.0-devel branch for further development of HD-audio codec quirks. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-08ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_streamsongxiebing
Fix sparse warning: sound/usb/qcom/qc_audio_offload.c:943:27: sparse: incorrect type in argument 2 expected unsigned int val but got snd_pcm_format_t. Explicitly cast pcm_format to unsigned int for snd_mask_leave(). Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202604062109.Oxi8JjWW-lkp@intel.com/ Signed-off-by: songxiebing <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260408083311.774173-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-07ASoC: Merge up v7.0-rc7Mark Brown
Merge tag 'v7.0-rc7' to get fixes that make my CI happier.
2026-04-06ALSA: scarlett2: Add missing sentinel initializer fieldPanagiotis Petrakopoulos
A "-Wmissing-field-initializers" warning was emitted when compiling the module using the W=2 option. There is a sentinel initializer field missing in the end of scarlett2_devices[]. Tested using a Scarlett Solo 4th gen. Fixes: d98cc489029d ("ALSA: scarlett2: Move USB IDs out from device_info struct") Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com> Link: https://patch.msgid.link/20260405222548.8903-1-npetrakopoulos2003@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-05Merge tag 'usb-7.0-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here are a bunch of USB and Thunderbolt fixes (most all are USB) for 7.0-rc7. More than I normally like this late in the release cycle, partly due to my recent travels, and partly due to people banging away on the USB gadget interfaces and apis more than normal (big shoutout to Android for getting the vendors to actually work upstream on this, that's a huge win overall for everyone here) Included in here are: - Small thunderbolt fix - new USB serial driver ids added - typec driver fixes - gadget driver fixes for some disconnect issues - other usb gadget driver fixes for reported problems with binding and unbinding devices as happens when a gadget device connects / disconnects from a system it is plugged into (or it switches device mode at a user's request, these things are complex little beasts...) - usb offload fixes (where USB audio tunnels through the controller while the main CPU is asleep) for when EMP spikes hit the system causing disconnects to happen (as often happens with static electricity in the winter months). This has been much reported by at least one vendor, and resolves the issues they have been seeing with this codepath. Can't wait for the "formal methods are the answer!" people to try to model that one properly... - Other small usb driver fixes for issues reported. All of these have been in linux-next this week, and before, with no reported issues, and I've personally been stressing these harder than normal on my systems here with no problems" * tag 'usb-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (39 commits) usb: gadget: f_hid: move list and spinlock inits from bind to alloc usb: host: xhci-sideband: delegate offload_usage tracking to class drivers usb: core: use dedicated spinlock for offload state usb: cdns3: gadget: fix state inconsistency on gadget init failure usb: dwc3: imx8mp: fix memory leak on probe failure path usb: gadget: f_uac1_legacy: validate control request size usb: ulpi: fix double free in ulpi_register_interface() error path usb: misc: usbio: Fix URB memory leak on submit failure USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam usb: cdns3: gadget: fix NULL pointer dereference in ep_queue usb: core: phy: avoid double use of 'usb3-phy' USB: serial: option: add MeiG Smart SRM825WN usb: gadget: f_rndis: Fix net_device lifecycle with device_move usb: gadget: f_subset: Fix net_device lifecycle with device_move usb: gadget: f_eem: Fix net_device lifecycle with device_move usb: gadget: f_ecm: Fix net_device lifecycle with device_move usb: gadget: u_ncm: Add kernel-doc comments for struct f_ncm_opts usb: gadget: f_rndis: Protect RNDIS options with mutex usb: gadget: f_subset: Fix unbalanced refcnt in geth_free dt-bindings: connector: add pd-disable dependency ...
2026-04-02ALSA: usb-audio: apply quirk for MOONDROP JU JiuCryolitia PukNgae
It(ID 31b2:0111 JU Jiu) reports a MIN value -12800 for volume control, but will mute when setting it less than -10880. Thanks to my girlfriend Kagura for reporting this issue. Cc: Kagura <me@mail.kagurach.uk> Cc: stable@vger.kernel.org Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev> Link: https://patch.msgid.link/20260402-syy-v1-1-068d3bc30ddc@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-02usb: host: xhci-sideband: delegate offload_usage tracking to class driversGuan-Yu Lin
Remove usb_offload_get() and usb_offload_put() from the xHCI sideband interrupter creation and removal paths. The responsibility of manipulating offload_usage now lies entirely with the USB class drivers. They have the precise context of when an offload data stream actually starts and stops, ensuring a much more accurate representation of offload activity for power management. Cc: stable <stable@kernel.org> Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage") Signed-off-by: Guan-Yu Lin <guanyulin@google.com> Tested-by: Hailong Liu <hailong.liu@oppo.com> Tested-by: hailong.liu@oppo.com Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260401123238.3790062-3-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-08 02:21:49 +0000