From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>,
Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10.y 1/2] ALSA: pcm: fix wait_time calculations
Date: Mon, 16 Mar 2026 13:00:44 -0400 [thread overview]
Message-ID: <20260316170045.993103-1-sashal@kernel.org> (raw)
In-Reply-To: <2026031627-certify-copied-e4eb@gregkh>
From: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
[ Upstream commit 3ed2b549b39f57239aad50a255ece353997183fd ]
... in wait_for_avail() and snd_pcm_drain().
t was calculated in seconds, so it would be pretty much always zero, to
be subsequently de-facto ignored due to being max(t, 10)'d. And then it
(i.e., 10) would be treated as secs, which doesn't seem right.
However, fixing it to properly calculate msecs would potentially cause
timeouts when using twice the period size for the default timeout (which
seems reasonable to me), so instead use the buffer size plus 10 percent
to be on the safe side ... but that still seems insufficient, presumably
because the hardware typically needs a moment to fire up. To compensate
for this, we up the minimal timeout to 100ms, which is still two orders
of magnitude less than the bogus minimum.
substream->wait_time was also misinterpreted as jiffies, despite being
documented as being in msecs. Only the soc/sof driver sets it - to 500,
which looks very much like msecs were intended.
Speaking of which, shouldn't snd_pcm_drain() also use substream->
wait_time?
As a drive-by, make the debug messages on timeout less confusing.
Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
Link: https://lore.kernel.org/r/20230405201219.2197774-1-oswald.buddenhagen@gmx.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Stable-dep-of: 9b1dbd69ba6f ("ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/pcm_lib.c | 11 +++++------
sound/core/pcm_native.c | 8 ++++----
2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 289f52af15b96..c28c91d4e7051 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1843,15 +1843,14 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
if (substream->wait_time) {
wait_time = substream->wait_time;
} else {
- wait_time = 10;
+ wait_time = 100;
if (runtime->rate) {
- long t = runtime->period_size * 2 /
- runtime->rate;
+ long t = runtime->buffer_size * 1100 / runtime->rate;
wait_time = max(t, wait_time);
}
- wait_time = msecs_to_jiffies(wait_time * 1000);
}
+ wait_time = msecs_to_jiffies(wait_time);
}
for (;;) {
@@ -1899,8 +1898,8 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
}
if (!tout) {
pcm_dbg(substream->pcm,
- "%s write error (DMA or IRQ trouble?)\n",
- is_playback ? "playback" : "capture");
+ "%s timeout (DMA or IRQ trouble?)\n",
+ is_playback ? "playback write" : "capture read");
err = -EIO;
break;
}
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index a6a3e8909be75..49bd053674bdb 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2155,12 +2155,12 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream,
if (runtime->no_period_wakeup)
tout = MAX_SCHEDULE_TIMEOUT;
else {
- tout = 10;
+ tout = 100;
if (runtime->rate) {
- long t = runtime->period_size * 2 / runtime->rate;
+ long t = runtime->buffer_size * 1100 / runtime->rate;
tout = max(t, tout);
}
- tout = msecs_to_jiffies(tout * 1000);
+ tout = msecs_to_jiffies(tout);
}
tout = schedule_timeout(tout);
@@ -2183,7 +2183,7 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream,
result = -ESTRPIPE;
else {
dev_dbg(substream->pcm->card->dev,
- "playback drain error (DMA or IRQ trouble?)\n");
+ "playback drain timeout (DMA or IRQ trouble?)\n");
snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
result = -EIO;
}
--
2.51.0
next prev parent reply other threads:[~2026-03-16 17:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-16 14:26 FAILED: patch "[PATCH] ALSA: pcm: fix use-after-free on linked stream runtime in" failed to apply to 5.10-stable tree gregkh
2026-03-16 17:00 ` Sasha Levin [this message]
2026-03-16 17:00 ` [PATCH 5.10.y 2/2] ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260316170045.993103-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=oswald.buddenhagen@gmx.de \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox