When the PSLVERR_RESP_EN parameter is set to 1, the device generates
an error response if an attempt is made to read an empty RBR (Receive
Buffer Register) while the FIFO is enabled.
In serial8250_do_startup(), calling serial_port_out(port, UART_LCR,
UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes
dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter
function enables the FIFO via serial_out(p, UART_FCR, p->fcr).
Execution proceeds to the serial_port_in(port, UART_RX).
This satisfies the PSLVERR trigger condition.
When another CPU (e.g., using printk()) is accessing the UART (UART
is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==
(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter
dw8250_force_idle().
Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock
to fix this issue.
Panic backtrace:
[ 0.442336] Oops - unknown exception [#1]
[ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a
[ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e
...
[ 0.442416] console_on_rootfs+0x26/0x70
Fixes: c49436b657d0 ("serial: 8250_dw: Improve unwritable LCR workaround")
Link: https://lore.kernel.org/all/84cydt5peu.fsf@jogness.linutronix.de/T/
Signed-off-by: Yunhui Cui <cuiyunhui(a)bytedance.com>
Cc: stable(a)vger.kernel.org
---
drivers/tty/serial/8250/8250_port.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 6d7b8c4667c9c..07fe818dffa34 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -2376,9 +2376,10 @@ int serial8250_do_startup(struct uart_port *port)
/*
* Now, initialize the UART
*/
- serial_port_out(port, UART_LCR, UART_LCR_WLEN8);
uart_port_lock_irqsave(port, &flags);
+ serial_port_out(port, UART_LCR, UART_LCR_WLEN8);
+
if (up->port.flags & UPF_FOURPORT) {
if (!up->port.irq)
up->port.mctrl |= TIOCM_OUT1;
--
2.39.5
Hi,
The patches fix some errors in the gs101 clock driver as well as a
trivial comment typo in the Exynos E850 clock driver.
Cheers,
Andre
Signed-off-by: André Draszik <andre.draszik(a)linaro.org>
---
André Draszik (3):
clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock
clk: samsung: exynos850: fix a comment
drivers/clk/samsung/clk-exynos850.c | 2 +-
drivers/clk/samsung/clk-gs101.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
---
base-commit: a0bea9e39035edc56a994630e6048c8a191a99d8
change-id: 20250519-samsung-clk-fixes-a4f5bfb54c73
Best regards,
--
André Draszik <andre.draszik(a)linaro.org>
Commit 1e7933a575ed ("uapi: Revert "bitops: avoid integer overflow in GENMASK(_ULL)"")
did not take in account that the usage of BITS_PER_LONG in __GENMASK() was
changed to __BITS_PER_LONG for UAPI-safety in
commit 3c7a8e190bc5 ("uapi: introduce uapi-friendly macros for GENMASK").
BITS_PER_LONG can not be used in UAPI headers as it derives from the kernel
configuration and not from the current compiler invocation.
When building compat userspace code or a compat vDSO its value will be
incorrect.
Switch back to __BITS_PER_LONG.
Fixes: 1e7933a575ed ("uapi: Revert "bitops: avoid integer overflow in GENMASK(_ULL)"")
Cc: stable(a)vger.kernel.org
Signed-off-by: Thomas Weißschuh <thomas.weissschuh(a)linutronix.de>
---
include/uapi/linux/bits.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/bits.h b/include/uapi/linux/bits.h
index 682b406e10679dc8baa188830ab0811e7e3e13e3..a04afef9efca42f062e142fcb33f5d267512b1e5 100644
--- a/include/uapi/linux/bits.h
+++ b/include/uapi/linux/bits.h
@@ -4,9 +4,9 @@
#ifndef _UAPI_LINUX_BITS_H
#define _UAPI_LINUX_BITS_H
-#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))
+#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
-#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
+#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
#define __GENMASK_U128(h, l) \
((_BIT128((h)) << 1) - (_BIT128(l)))
---
base-commit: e271ed52b344ac02d4581286961d0c40acc54c03
change-id: 20250606-uapi-genmask-e07667de69ec
Best regards,
--
Thomas Weißschuh <thomas.weissschuh(a)linutronix.de>
From: Pali Rohár <pali(a)kernel.org>
[ Upstream commit 89381c72d52094988e11d23ef24a00066a0fa458 ]
[MS-CIFS] specification in section 2.2.4.53.1 where is described
SMB_COM_SESSION_SETUP_ANDX Request, for SessionKey field says:
The client MUST set this field to be equal to the SessionKey field in
the SMB_COM_NEGOTIATE Response for this SMB connection.
Linux SMB client currently set this field to zero. This is working fine
against Windows NT SMB servers thanks to [MS-CIFS] product behavior <94>:
Windows NT Server ignores the client's SessionKey.
For compatibility with [MS-CIFS], set this SessionKey field in Session
Setup Request to value retrieved from Negotiate response.
Signed-off-by: Pali Rohár <pali(a)kernel.org>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
Based on my comprehensive analysis of both the commit message and code
changes, examining the current kernel tree context: **YES** ## Extensive
Analysis ### **Nature of the Fix** This is a **specification compliance
fix** for SMB1 protocol handling. The commit addresses a clear violation
of the MS-CIFS specification section 2.2.4.53.1, which mandates that the
SessionKey field in SMB_COM_SESSION_SETUP_ANDX Request must be set to
the value from the SMB_COM_NEGOTIATE Response. ### **Code Changes
Analysis** **1. Structural Changes (Low Risk)** - **cifsglob.h**: Adds
`__le32 session_key_id` to `TCP_Server_Info` structure - minimal ABI
impact as this is kernel-internal - **cifspdu.h**: Corrects endianness
annotations from `__u32` to `__le32` - pure annotation fix, no
behavioral change **2. Functional Changes (Contained and Safe)** -
**cifssmb.c**: Captures SessionKey from negotiate response
(`server->session_key_id = pSMBr->SessionKey`) - simple field assignment
- **sess.c**: Sets SessionKey in session setup request
(`pSMB->req.SessionKey = server->session_key_id`) - follows
specification requirement ### **Risk Assessment** **Minimal Regression
Risk:** - Changes are isolated to SMB1 legacy protocol code - Current
behavior (setting SessionKey to zero) works with Windows NT due to MS-
CIFS product behavior <94> - New behavior follows specification exactly,
improving compatibility with non-Windows SMB1 servers - No security
implications - purely a protocol compliance improvement **Code
Maturity:** - SMB1 session setup code is very mature and stable -
Limited recent changes in this area except compatibility fixes - Well-
understood code path with clear specification backing ### **Backport
Suitability Criteria Met** **1. Important Bug Fix:** ✅ Fixes protocol
specification violation that could cause compatibility issues with
strict SMB1 implementations **2. Small and Contained:** ✅ Four minimal
changes across related files, all implementing the same specification
requirement **3. Clear Side Effects:** ✅ No side effects beyond fixing
the specification compliance issue **4. No Architectural Changes:** ✅
Simple field additions and assignments, no structural changes **5. Non-
Critical Subsystem:** ✅ Legacy SMB1 protocol code, deprecated since 2017
**6. Minimal Risk:** ✅ Maintains backward compatibility while improving
forward compatibility **7. Stable Tree Rules Compliance:** ✅ Important
compatibility bugfix with minimal regression risk ### **Comparison to
Similar Commits** This commit closely matches the pattern of **Similar
Commit #3** and **Similar Commit #5** (both marked YES for backporting):
- Protocol compliance improvements - Session setup related fixes - Clear
specification backing - Minimal, contained changes - Authored by
maintainers (Steve French involvement) ### **Conclusion** This commit
represents an ideal stable backport candidate: a clear specification
compliance fix with minimal code changes, no security implications, and
improvement in interoperability. The fix ensures Linux kernel SMB client
properly follows MS-CIFS specification, which is valuable for enterprise
environments using diverse SMB1 server implementations.
fs/smb/client/cifsglob.h | 1 +
fs/smb/client/cifspdu.h | 6 +++---
fs/smb/client/cifssmb.c | 1 +
fs/smb/client/sess.c | 1 +
4 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h
index 17fce0afb297f..9c5aa646b8cc8 100644
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -675,6 +675,7 @@ struct TCP_Server_Info {
char workstation_RFC1001_name[RFC1001_NAME_LEN_WITH_NULL];
__u32 sequence_number; /* for signing, protected by srv_mutex */
__u32 reconnect_instance; /* incremented on each reconnect */
+ __le32 session_key_id; /* retrieved from negotiate response and send in session setup request */
struct session_key session_key;
unsigned long lstrp; /* when we got last response from this server */
struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */
diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h
index 9cb4577063344..a682c50d7ace4 100644
--- a/fs/smb/client/cifspdu.h
+++ b/fs/smb/client/cifspdu.h
@@ -557,7 +557,7 @@ typedef union smb_com_session_setup_andx {
__le16 MaxBufferSize;
__le16 MaxMpxCount;
__le16 VcNumber;
- __u32 SessionKey;
+ __le32 SessionKey;
__le16 SecurityBlobLength;
__u32 Reserved;
__le32 Capabilities; /* see below */
@@ -576,7 +576,7 @@ typedef union smb_com_session_setup_andx {
__le16 MaxBufferSize;
__le16 MaxMpxCount;
__le16 VcNumber;
- __u32 SessionKey;
+ __le32 SessionKey;
__le16 CaseInsensitivePasswordLength; /* ASCII password len */
__le16 CaseSensitivePasswordLength; /* Unicode password length*/
__u32 Reserved; /* see below */
@@ -614,7 +614,7 @@ typedef union smb_com_session_setup_andx {
__le16 MaxBufferSize;
__le16 MaxMpxCount;
__le16 VcNumber;
- __u32 SessionKey;
+ __le32 SessionKey;
__le16 PasswordLength;
__u32 Reserved; /* encrypt key len and offset */
__le16 ByteCount;
diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 6077fe1dcc9ce..0c6ade1968947 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -469,6 +469,7 @@ CIFSSMBNegotiate(const unsigned int xid,
server->max_rw = le32_to_cpu(pSMBr->MaxRawSize);
cifs_dbg(NOISY, "Max buf = %d\n", ses->server->maxBuf);
server->capabilities = le32_to_cpu(pSMBr->Capabilities);
+ server->session_key_id = pSMBr->SessionKey;
server->timeAdj = (int)(__s16)le16_to_cpu(pSMBr->ServerTimeZone);
server->timeAdj *= 60;
diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
index c8f7ae0a20064..883d1cb1fc8b0 100644
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -605,6 +605,7 @@ static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
USHRT_MAX));
pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
pSMB->req.VcNumber = cpu_to_le16(1);
+ pSMB->req.SessionKey = server->session_key_id;
/* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
--
2.39.5
From: Cezary Rojewski <cezary.rojewski(a)intel.com>
[ Upstream commit 3f100f524e75586537e337b34d18c8d604b398e7 ]
For the classic snd_hda_intel driver, codec->card and bus->card point to
the exact same thing. When snd_card_diconnect() fires, bus->shutdown is
set thanks to azx_dev_disconnect(). card->shutdown is already set when
that happens but both provide basically the same functionality.
For the DSP snd_soc_avs driver where multiple codecs are located on
multiple cards, bus->shutdown 'shortcut' is not sufficient. One codec
card may be unregistered while other codecs are still operational.
Proper check in form of card->shutdown must be used to verify whether
the codec's card is being shut down.
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com>
Link: https://patch.msgid.link/20250530141309.2943404-1-cezary.rojewski@intel.com
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
**YES**
This commit should be backported to stable kernel trees. Here's my
extensive analysis:
## Technical Analysis
### Core Problem Being Fixed
The commit addresses a **shutdown race condition** in multi-codec HDA
systems, specifically in DSP/AVS drivers where multiple HDA codecs exist
on the same sound card but with separate bus instances. The change
modifies line 47 in `sound/pci/hda/hda_bind.c`:
**Before:**
```c
if (codec->bus->shutdown)
return;
```
**After:**
```c
if (codec->card->shutdown || codec->bus->shutdown)
return;
```
### Why This is a Good Backport Candidate
**1. Bug Fix Nature - Small and Contained**
- This is a clear **bug fix** addressing a specific shutdown race
condition
- The change is **minimal** (adding one condition check) and **well-
contained**
- No architectural changes or new features introduced
- Low risk of introducing regressions
**2. Critical Subsystem Impact**
- Affects **HD-audio subsystem** which is critical for audio
functionality
- Could prevent system crashes or hangs during shutdown in multi-codec
scenarios
- Improves system stability during shutdown sequences
**3. Technical Correctness**
The fix addresses a **fundamental timing issue**:
- In multi-codec systems, `card->shutdown` is set at the ALSA core level
during `snd_card_disconnect()`
- `bus->shutdown` is set later at the HDA controller level during
individual codec shutdown
- **Gap exists** where unsol events could be processed after card
shutdown but before bus shutdown
- This can cause codec operations on an already-disconnected sound card
**4. Follows Stable Tree Criteria**
- **Important bug fix**: Prevents potential system instability during
shutdown
- **Minimal risk**: Only adds an additional safety check, doesn't change
existing logic
- **Well-understood**: The change is straightforward and follows
existing patterns seen in similar commits
- **Confined to subsystem**: Only affects HDA audio subsystem
**5. Consistency with Similar Backported Commits**
This follows the exact same pattern as the historical commits that were
successfully backported:
- **Similar Commit #1**: Added `bus->shutdown` check to prevent unsol
events during shutdown - **Backported (YES)**
- **Similar Commit #2**: Added suspend/resume state check to unsol
handler - **Backported (YES)**
- **Similar Commit #3**: Added jack disconnection during codec unbind -
**Backported (YES)**
- **Similar Commit #4**: Added bus_probing flag to serialize codec
registration - **Backported (YES)**
All these commits follow the same pattern: **small, targeted fixes to
prevent race conditions in HDA shutdown/initialization sequences**.
**6. Real-World Impact**
- Affects **DSP/AVS audio systems** which are increasingly common in
modern hardware
- Without this fix, systems with multiple audio codecs could experience:
- Kernel oops during shutdown
- System hangs
- Audio subsystem corruption
- Unpredictable behavior during reboot sequences
### Risk Assessment
**Very Low Risk:**
- The change only **adds** a safety check, doesn't remove existing
functionality
- `card->shutdown` check is used extensively throughout the ALSA
subsystem already
- Maintains **backward compatibility** completely
- If `card->shutdown` is false, behavior is identical to before
- No changes to data structures, APIs, or functional logic
### Conclusion
This commit represents a **textbook stable backport candidate**: it's a
small, well-understood bug fix that addresses a real stability issue in
a critical subsystem with minimal risk of regression. The pattern
matches multiple previously successful backports in the same subsystem,
and the technical merit is clear.
sound/pci/hda/hda_bind.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 17a25e453f60c..047fe6cca7f1a 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -44,7 +44,7 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
struct hda_codec *codec = container_of(dev, struct hda_codec, core);
/* ignore unsol events during shutdown */
- if (codec->bus->shutdown)
+ if (codec->card->shutdown || codec->bus->shutdown)
return;
/* ignore unsol events during system suspend/resume */
--
2.39.5
From: Cezary Rojewski <cezary.rojewski(a)intel.com>
[ Upstream commit 3f100f524e75586537e337b34d18c8d604b398e7 ]
For the classic snd_hda_intel driver, codec->card and bus->card point to
the exact same thing. When snd_card_diconnect() fires, bus->shutdown is
set thanks to azx_dev_disconnect(). card->shutdown is already set when
that happens but both provide basically the same functionality.
For the DSP snd_soc_avs driver where multiple codecs are located on
multiple cards, bus->shutdown 'shortcut' is not sufficient. One codec
card may be unregistered while other codecs are still operational.
Proper check in form of card->shutdown must be used to verify whether
the codec's card is being shut down.
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com>
Link: https://patch.msgid.link/20250530141309.2943404-1-cezary.rojewski@intel.com
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
**YES**
This commit should be backported to stable kernel trees. Here's my
extensive analysis:
## Technical Analysis
### Core Problem Being Fixed
The commit addresses a **shutdown race condition** in multi-codec HDA
systems, specifically in DSP/AVS drivers where multiple HDA codecs exist
on the same sound card but with separate bus instances. The change
modifies line 47 in `sound/pci/hda/hda_bind.c`:
**Before:**
```c
if (codec->bus->shutdown)
return;
```
**After:**
```c
if (codec->card->shutdown || codec->bus->shutdown)
return;
```
### Why This is a Good Backport Candidate
**1. Bug Fix Nature - Small and Contained**
- This is a clear **bug fix** addressing a specific shutdown race
condition
- The change is **minimal** (adding one condition check) and **well-
contained**
- No architectural changes or new features introduced
- Low risk of introducing regressions
**2. Critical Subsystem Impact**
- Affects **HD-audio subsystem** which is critical for audio
functionality
- Could prevent system crashes or hangs during shutdown in multi-codec
scenarios
- Improves system stability during shutdown sequences
**3. Technical Correctness**
The fix addresses a **fundamental timing issue**:
- In multi-codec systems, `card->shutdown` is set at the ALSA core level
during `snd_card_disconnect()`
- `bus->shutdown` is set later at the HDA controller level during
individual codec shutdown
- **Gap exists** where unsol events could be processed after card
shutdown but before bus shutdown
- This can cause codec operations on an already-disconnected sound card
**4. Follows Stable Tree Criteria**
- **Important bug fix**: Prevents potential system instability during
shutdown
- **Minimal risk**: Only adds an additional safety check, doesn't change
existing logic
- **Well-understood**: The change is straightforward and follows
existing patterns seen in similar commits
- **Confined to subsystem**: Only affects HDA audio subsystem
**5. Consistency with Similar Backported Commits**
This follows the exact same pattern as the historical commits that were
successfully backported:
- **Similar Commit #1**: Added `bus->shutdown` check to prevent unsol
events during shutdown - **Backported (YES)**
- **Similar Commit #2**: Added suspend/resume state check to unsol
handler - **Backported (YES)**
- **Similar Commit #3**: Added jack disconnection during codec unbind -
**Backported (YES)**
- **Similar Commit #4**: Added bus_probing flag to serialize codec
registration - **Backported (YES)**
All these commits follow the same pattern: **small, targeted fixes to
prevent race conditions in HDA shutdown/initialization sequences**.
**6. Real-World Impact**
- Affects **DSP/AVS audio systems** which are increasingly common in
modern hardware
- Without this fix, systems with multiple audio codecs could experience:
- Kernel oops during shutdown
- System hangs
- Audio subsystem corruption
- Unpredictable behavior during reboot sequences
### Risk Assessment
**Very Low Risk:**
- The change only **adds** a safety check, doesn't remove existing
functionality
- `card->shutdown` check is used extensively throughout the ALSA
subsystem already
- Maintains **backward compatibility** completely
- If `card->shutdown` is false, behavior is identical to before
- No changes to data structures, APIs, or functional logic
### Conclusion
This commit represents a **textbook stable backport candidate**: it's a
small, well-understood bug fix that addresses a real stability issue in
a critical subsystem with minimal risk of regression. The pattern
matches multiple previously successful backports in the same subsystem,
and the technical merit is clear.
sound/pci/hda/hda_bind.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 0a83afa5f373c..6625643f333e8 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -44,7 +44,7 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
struct hda_codec *codec = container_of(dev, struct hda_codec, core);
/* ignore unsol events during shutdown */
- if (codec->bus->shutdown)
+ if (codec->card->shutdown || codec->bus->shutdown)
return;
/* ignore unsol events during system suspend/resume */
--
2.39.5
From: Cezary Rojewski <cezary.rojewski(a)intel.com>
[ Upstream commit 3f100f524e75586537e337b34d18c8d604b398e7 ]
For the classic snd_hda_intel driver, codec->card and bus->card point to
the exact same thing. When snd_card_diconnect() fires, bus->shutdown is
set thanks to azx_dev_disconnect(). card->shutdown is already set when
that happens but both provide basically the same functionality.
For the DSP snd_soc_avs driver where multiple codecs are located on
multiple cards, bus->shutdown 'shortcut' is not sufficient. One codec
card may be unregistered while other codecs are still operational.
Proper check in form of card->shutdown must be used to verify whether
the codec's card is being shut down.
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com>
Link: https://patch.msgid.link/20250530141309.2943404-1-cezary.rojewski@intel.com
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
**YES**
This commit should be backported to stable kernel trees. Here's my
extensive analysis:
## Technical Analysis
### Core Problem Being Fixed
The commit addresses a **shutdown race condition** in multi-codec HDA
systems, specifically in DSP/AVS drivers where multiple HDA codecs exist
on the same sound card but with separate bus instances. The change
modifies line 47 in `sound/pci/hda/hda_bind.c`:
**Before:**
```c
if (codec->bus->shutdown)
return;
```
**After:**
```c
if (codec->card->shutdown || codec->bus->shutdown)
return;
```
### Why This is a Good Backport Candidate
**1. Bug Fix Nature - Small and Contained**
- This is a clear **bug fix** addressing a specific shutdown race
condition
- The change is **minimal** (adding one condition check) and **well-
contained**
- No architectural changes or new features introduced
- Low risk of introducing regressions
**2. Critical Subsystem Impact**
- Affects **HD-audio subsystem** which is critical for audio
functionality
- Could prevent system crashes or hangs during shutdown in multi-codec
scenarios
- Improves system stability during shutdown sequences
**3. Technical Correctness**
The fix addresses a **fundamental timing issue**:
- In multi-codec systems, `card->shutdown` is set at the ALSA core level
during `snd_card_disconnect()`
- `bus->shutdown` is set later at the HDA controller level during
individual codec shutdown
- **Gap exists** where unsol events could be processed after card
shutdown but before bus shutdown
- This can cause codec operations on an already-disconnected sound card
**4. Follows Stable Tree Criteria**
- **Important bug fix**: Prevents potential system instability during
shutdown
- **Minimal risk**: Only adds an additional safety check, doesn't change
existing logic
- **Well-understood**: The change is straightforward and follows
existing patterns seen in similar commits
- **Confined to subsystem**: Only affects HDA audio subsystem
**5. Consistency with Similar Backported Commits**
This follows the exact same pattern as the historical commits that were
successfully backported:
- **Similar Commit #1**: Added `bus->shutdown` check to prevent unsol
events during shutdown - **Backported (YES)**
- **Similar Commit #2**: Added suspend/resume state check to unsol
handler - **Backported (YES)**
- **Similar Commit #3**: Added jack disconnection during codec unbind -
**Backported (YES)**
- **Similar Commit #4**: Added bus_probing flag to serialize codec
registration - **Backported (YES)**
All these commits follow the same pattern: **small, targeted fixes to
prevent race conditions in HDA shutdown/initialization sequences**.
**6. Real-World Impact**
- Affects **DSP/AVS audio systems** which are increasingly common in
modern hardware
- Without this fix, systems with multiple audio codecs could experience:
- Kernel oops during shutdown
- System hangs
- Audio subsystem corruption
- Unpredictable behavior during reboot sequences
### Risk Assessment
**Very Low Risk:**
- The change only **adds** a safety check, doesn't remove existing
functionality
- `card->shutdown` check is used extensively throughout the ALSA
subsystem already
- Maintains **backward compatibility** completely
- If `card->shutdown` is false, behavior is identical to before
- No changes to data structures, APIs, or functional logic
### Conclusion
This commit represents a **textbook stable backport candidate**: it's a
small, well-understood bug fix that addresses a real stability issue in
a critical subsystem with minimal risk of regression. The pattern
matches multiple previously successful backports in the same subsystem,
and the technical merit is clear.
sound/pci/hda/hda_bind.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 8e35009ec25cb..a22f723ab3ab6 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -45,7 +45,7 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
struct hda_codec *codec = container_of(dev, struct hda_codec, core);
/* ignore unsol events during shutdown */
- if (codec->bus->shutdown)
+ if (codec->card->shutdown || codec->bus->shutdown)
return;
/* ignore unsol events during system suspend/resume */
--
2.39.5
From: Cezary Rojewski <cezary.rojewski(a)intel.com>
[ Upstream commit 3f100f524e75586537e337b34d18c8d604b398e7 ]
For the classic snd_hda_intel driver, codec->card and bus->card point to
the exact same thing. When snd_card_diconnect() fires, bus->shutdown is
set thanks to azx_dev_disconnect(). card->shutdown is already set when
that happens but both provide basically the same functionality.
For the DSP snd_soc_avs driver where multiple codecs are located on
multiple cards, bus->shutdown 'shortcut' is not sufficient. One codec
card may be unregistered while other codecs are still operational.
Proper check in form of card->shutdown must be used to verify whether
the codec's card is being shut down.
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com>
Link: https://patch.msgid.link/20250530141309.2943404-1-cezary.rojewski@intel.com
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
**YES**
This commit should be backported to stable kernel trees. Here's my
extensive analysis:
## Technical Analysis
### Core Problem Being Fixed
The commit addresses a **shutdown race condition** in multi-codec HDA
systems, specifically in DSP/AVS drivers where multiple HDA codecs exist
on the same sound card but with separate bus instances. The change
modifies line 47 in `sound/pci/hda/hda_bind.c`:
**Before:**
```c
if (codec->bus->shutdown)
return;
```
**After:**
```c
if (codec->card->shutdown || codec->bus->shutdown)
return;
```
### Why This is a Good Backport Candidate
**1. Bug Fix Nature - Small and Contained**
- This is a clear **bug fix** addressing a specific shutdown race
condition
- The change is **minimal** (adding one condition check) and **well-
contained**
- No architectural changes or new features introduced
- Low risk of introducing regressions
**2. Critical Subsystem Impact**
- Affects **HD-audio subsystem** which is critical for audio
functionality
- Could prevent system crashes or hangs during shutdown in multi-codec
scenarios
- Improves system stability during shutdown sequences
**3. Technical Correctness**
The fix addresses a **fundamental timing issue**:
- In multi-codec systems, `card->shutdown` is set at the ALSA core level
during `snd_card_disconnect()`
- `bus->shutdown` is set later at the HDA controller level during
individual codec shutdown
- **Gap exists** where unsol events could be processed after card
shutdown but before bus shutdown
- This can cause codec operations on an already-disconnected sound card
**4. Follows Stable Tree Criteria**
- **Important bug fix**: Prevents potential system instability during
shutdown
- **Minimal risk**: Only adds an additional safety check, doesn't change
existing logic
- **Well-understood**: The change is straightforward and follows
existing patterns seen in similar commits
- **Confined to subsystem**: Only affects HDA audio subsystem
**5. Consistency with Similar Backported Commits**
This follows the exact same pattern as the historical commits that were
successfully backported:
- **Similar Commit #1**: Added `bus->shutdown` check to prevent unsol
events during shutdown - **Backported (YES)**
- **Similar Commit #2**: Added suspend/resume state check to unsol
handler - **Backported (YES)**
- **Similar Commit #3**: Added jack disconnection during codec unbind -
**Backported (YES)**
- **Similar Commit #4**: Added bus_probing flag to serialize codec
registration - **Backported (YES)**
All these commits follow the same pattern: **small, targeted fixes to
prevent race conditions in HDA shutdown/initialization sequences**.
**6. Real-World Impact**
- Affects **DSP/AVS audio systems** which are increasingly common in
modern hardware
- Without this fix, systems with multiple audio codecs could experience:
- Kernel oops during shutdown
- System hangs
- Audio subsystem corruption
- Unpredictable behavior during reboot sequences
### Risk Assessment
**Very Low Risk:**
- The change only **adds** a safety check, doesn't remove existing
functionality
- `card->shutdown` check is used extensively throughout the ALSA
subsystem already
- Maintains **backward compatibility** completely
- If `card->shutdown` is false, behavior is identical to before
- No changes to data structures, APIs, or functional logic
### Conclusion
This commit represents a **textbook stable backport candidate**: it's a
small, well-understood bug fix that addresses a real stability issue in
a critical subsystem with minimal risk of regression. The pattern
matches multiple previously successful backports in the same subsystem,
and the technical merit is clear.
sound/pci/hda/hda_bind.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 890c2f7c33fc2..4c7355a0814d1 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -45,7 +45,7 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
struct hda_codec *codec = container_of(dev, struct hda_codec, core);
/* ignore unsol events during shutdown */
- if (codec->bus->shutdown)
+ if (codec->card->shutdown || codec->bus->shutdown)
return;
/* ignore unsol events during system suspend/resume */
--
2.39.5