[staging-next-25.11] alsa-lib: fix patch for CVE-2026-25068 for v1.2.14

[whispersofthedawn]

#492079 introduced a patch for CVE-2026-25068, which was backported to staging-25.11 in #492453. However, the patch fails to compile when ported directly to 25.11 since the way of doing error handling changed from an SNDERR macro to an snd_error function between v1.2.14 (which is on 25.11) and on v1.2.15. In order to fix this, we vendor the patch and change the offending line like so:

- +			snd_error(TOPOLOGY, "mixer: unexpected channel count %d", map->num_channels);
+ +			SNDERR("mixer: unexpected channel count %d", map->num_channels);

Alternatively, the package itself could be updated? Not familiar enough with alsa-lib to assess whether that should happen/is liable to cause breakage. This is probably the lowest impact option, but I don't know if it's the best.

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

[github-actions]

This report is automatically generated by the PR / Check / cherry-pick CI workflow.

Some of the commits in this PR require the author's and reviewer's attention.

If you need to merge this PR despite the warnings, please dismiss this review shortly before merging.

Important

7b1d330 is not a cherry-pick, because: fix that does not apply to unstable since it is on a later version of package. Please review this commit manually.

Hint: The full diffs are also available in the runner logs with slightly better highlighting.

[mdaniels5757]

The spacing in your patch is different, but I verified that it's the otherwise the same as Ubuntu's (from alsa-lib_1.2.14-1ubuntu1.1.debian.tar.xz, so not suitable for fetchpatch).

as above

[mdaniels5757]

Built on aarch64-linux at HEAD, I should've mentioned.