[PATCH v1 0/5] ALSA: virtio: Fix request lifetime and error recovery

[Joonho Lee <mynameisjune111@gmail.com>]

A failed PCM start or a timed-out request can leave virtio-snd with
messages still owned by the device. Retrying a stream can then reuse
pending messages, and freeing the ALSA buffer or a control payload can
leave a descriptor pointing at released memory.

This series fixes the enqueue and start error paths, then keeps control
requests and PCM backing pages alive until completion or device reset.
It is based on Takashi Iwai's sound.git for-next branch at the base
commit below. Please apply the five patches in order.

Patches 1 and 2 fix partial enqueue notification and failed-start state.
Patch 3 serializes control notification with teardown and retains queue
references through reset. Patch 4 retains the vmalloc-backed PCM pages
when ALSA releases the buffer mapping after a failed drain. Patch 5 puts
control payloads under the message reference count; it needs patch 3's
reset lifetime handling as well as normal completion handling.

Keeping a message object alive is not sufficient by itself: its payload
must remain alive too. Patches 3 and 5 therefore need to stay together
when evaluating the control-request lifetime fix. An unresponsive device
can retain memory until reset. Patch 4 adds a page-pointer array and page
references per PCM buffer; patch 5 adds owned payload storage and copies.

Validation:
- ARM64 GCC 14.2.0 W=1 builds passed for the final series and the
  intermediate tree through patch 4, with no build warnings in those
  runs. The tree through patch 3 also passed a W=1 driver rebuild.
  Patches 1 and 2 were not separately kernel-built or booted.
- Source-extracted ASan/UBSan tests passed 340 assertions covering partial
  enqueue, failed start, allocation failure, timeout/interruption, late
  access, cleanup and a subsequent operation. These use kernel shims;
  they do not prove real kernel concurrency.
- An ARM64 KASAN guest with a fault-injecting QEMU virtio-sound backend
  reproduced PCM-page and PCM_INFO-payload use-after-free on the tree
  through patch 3. Two runs of each case with the complete series had no
  KASAN or other kernel diagnostics and passed subsequent capture and
  playback checks. A separate drain-timeout/reset/rebind run also passed.

The backend deliberately holds a capture descriptor past RELEASE, or a
PCM_INFO response past the caller's timeout, then accesses the original
scatterlist. A test-only guest observer reads the referenced storage so
KASAN can check it; external DMA alone is not instrumented by KASAN. The
reset test checks that the backend's delayed callback does not run after
reset. It does not independently inspect guest memory after reset.

These are local fault-injection results, using QEMU's none audio backend.
TLV and enum payloads have source-shim coverage only. No physical audio,
Apple VZ or Docker Desktop microphone validation is claimed for this
series. VZ-specific completion compatibility changes are excluded. The
playback ACK callback's inability to propagate enqueue errors is also
outside this series. No new userspace ABI or feature is introduced.

Reproducer source and instructions:
https://github.com/whatisyourname0/virtio-snd-reproducer/tree/8e6ef41bb9c102af4f9d9809bc9fa9bd6243fb02

The source-only package includes the host harnesses, QEMU fault-injection
patch, guest observer and build/run scripts. The 340 host assertions were
rerun on macOS arm64 and Debian Linux aarch64. The portable QEMU validators
passed PCM, PCM_INFO and reset checks using existing build artifacts.
A newly generated initramfs also passed the PCM and recovery checks.
The complete QEMU/kernel source rebuild recipe has not been run end to
end from this package; that boundary is recorded in its README.

AI assistance (Codex, including GPT-6 Luna Max) was used for code analysis,
implementation, test fixtures, validation and patch text. The work was
prompted to isolate generic virtio-snd lifetime and error fixes from
VZ-specific behavior, reproduce the failures, and check recovery. Each
patch carries Assisted-by: LLM.

Joonho Lee (5):
  ALSA: virtio: Notify queued PCM messages after send errors
  ALSA: virtio: Recover PCM state after a failed start
  ALSA: virtio: Retain control requests through device reset
  ALSA: virtio: Retain PCM DMA pages until messages are freed
  ALSA: virtio: Keep control payloads in refcounted messages

 sound/virtio/virtio_card.c    |   6 +-
 sound/virtio/virtio_card.h    |   2 +
 sound/virtio/virtio_ctl_msg.c | 170 ++++++++++++++++++++++++++++------
 sound/virtio/virtio_ctl_msg.h |  20 +++-
 sound/virtio/virtio_kctl.c    | 101 ++++++++++----------
 sound/virtio/virtio_pcm.h     |   5 +
 sound/virtio/virtio_pcm_msg.c | 124 +++++++++++++++++++++++--
 sound/virtio/virtio_pcm_ops.c |  65 +++++++++++--
 8 files changed, 398 insertions(+), 95 deletions(-)


base-commit: 8d70e364e866bdfca81eee24d0688fac9472cfb9
-- 
2.54.0 (Apple Git-157)