From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.176 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793263857; b=qwjMI1Wi8AsN4ZZeNUBwQOMx1LH/z/A0mJ9Np0VdBNGqGMMv/0RH/jthvH1NVn9DyCCb Kxu8rkk7B3udGvw0I68gBEQDlMSixlhQs6eQAxw+xRpgCLIN2y1HHoQxtIhhNDxFowh01 sm3DW/BgES++5U41W9d0qw3Y8BMlLNK5MvzdAMkiuzbi71kATSme6vpYZXXATQvCJsKBE +i/MgSuxRNBsMYwKNF75EadNFboIOekTNioK1+FE8QkF3orT1c45HnMj7gEATid5OjzgX 6K3yXPnVmv9WZ2gbfMd6VcGs1wTp5RtbSLkrIDFgA6wNwhM+v8O8tLa11jjFVZx796w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793263857; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=9vdyM2XBkHREi9ZLEpDGlK6JdyxKbK63i++KHNm90MY=; b=Dxmqb0iP3xM9+JwbasqT+cK4lFQwyLHDYPq4v6slfvbhR9wI/jFzDV6fyil4+kfRJk/B sOz8Apwk1a5yF8n2YJqB8eC8dENJWQl1+rOnkrIsDa42O/qVWgdOqINiWSn5TV7fJfRTD fo6C52j2hPWTf0NiWMCMDQ/yCYpcKQ/8nv5S5VPoOYSXg3CX/lSm3OMoWb5jFAciyh1Zz /F8j8JCClM58rPM3ZnHkKfhY77FhiyLxmtPNOBhIVsKWYzBR3NIkCnez7lOT1j3Z/XYin s5pO2ntMAtJxQaxASzcByjse7lJl4npLb73M76ACc68bYpp4MEtuqFsnebEvEctUdNA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=EfWJlSzY; arc=none smtp.remote-ip=209.85.214.176 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61C4D606A31E for ; Thu, 29 Oct 2026 08:50:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 61C4D606A31E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=EfWJlSzY Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e9d1114320so14190995ad.3 for ; Thu, 29 Oct 2026 01:50:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793263857; x=1793868657; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9vdyM2XBkHREi9ZLEpDGlK6JdyxKbK63i++KHNm90MY=; b=EfWJlSzYioB1aTFu3pHSiFof8MZg6Ny2jcgF1ctY5Fev2FHqYYSU0X/qyCDYvLtWdM rK8kemQwTBylhk7EbuQahiMLy1XIQr07IZlAUawP+W5Dd+YrS45IWEQ0tHQe5A9c0Z7l 81crH/nZT1Hnrjuy9A2fR8lBJ0qIHnEJ7hufs7EHS9s6ly/hsth/+skyKBC5NFPG5ebh 47Ep5Ln2SilYmq8HKTbPRDBwZ1dxggMaGdfigvKhrR51etYYGTtxR6X4M1ma0Q4JI6qa GI7uoA0wvWQPziJUU1lzg0hl+wYgOlV+PLgnetW3kR0pjoiloksUjFiPycLI9bn9kGJ1 eFSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793263857; x=1793868657; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9vdyM2XBkHREi9ZLEpDGlK6JdyxKbK63i++KHNm90MY=; b=qAZZZ/q9ZMC6qA5SqDEkfD3YC/fRn95rkW4P9FfkjXJQd4lJNJTFc1aVMOgeZGN3jx kGTnXHx1VUIj2zndQUdrs+o2PyFNbHRlADDbWCsJRhRzGXy+SZ9ZCEKwboIiy/QzFXLO EKPkgbCyU/VRd2dt/ZW7C92th5sFb2A0dnyQXC9hr9BP5sl/jGWXRfd3HeOupkB7b6qw r6mtCq5kvcZwU/hSt3zwvPHdM6QuQe4ew3cAufcTy+O/XxVxs6ag2EkYkxtbPFjcdqYG T2f1gRAW/MT5rv1ZD2f9mx3eG17YsgEb2qSliT0+v0AvuahNoWGtu6F+9EhLwAyPTTZx 6DuQ== X-Forwarded-Encrypted: i=1; AKwUvByzhI0UP+hIar+8yoNIhoR/oz4MWEdriZUmuAWwDvxuQLC5MKSzYOITcRFKRwFow+LJ0WTAz5qJOCxBKQYa6w==@lists.linux.dev X-Gm-Message-State: AFq9FYI5hGqgbmZi9WopMhLzu3mDlHlDMM4JWU7417EYcSpKRc4qIHSR RsuhnQO1oNE2qlTEfl+BTPbrnONLOmXZfye7t+6PtTlfiO8Ucd8F177u X-Gm-Gg: AYBFou0uqMupsYaulJk+eIHBAn4mRFkpc3wChbgbJDmMz9SrZmQSYSCn31jZ6ItDx8n HESbKUeVp2sRN/VaHaULnfBwBHSkzGCwp5zN6JLrowRaWZaZVfgstl8JNXC3qcAIx3FF4TD2toc 6JMpV5ruE6TpXLn304Lp5CdkQFdYyKKTVzfnw/q5KeRr1KIoJZb58bGWW3dQ11Cws+NGhhFUQg0 8gxsyKqtMeRdq9DEku0laroVatakHLvWmF5rhL+6PkwqpAf5Of8ttCy09rlP7QmROxiXVAhvjFz CdXU6KuXTJn4IAhmtPbCzLyvoLVkXE4mNPBLYxVWehd0bWiUzfHP85XfEGS4/jHwOcn+qSUU9OL 4lq9r5JMkYRNAAbwDDu+1CMXM1T92Juyul4hqEsyojOM2Ab9rxbi0zdamtwYjaLQARyLZl5+0Hr seqxvsDxJb1xQpotfN2Hc18oURi2yLA6q7Ed5Lii7zwOyEOjJ0iMVuLTBY0c5Ab3QaQkKVq4A/i Au16Qd9gaTrHtBRxgO7UhFRLFcWpyi65Akr7jq8PCDCFeYS3ZtkPOnys1mXv79WJLYquA0GlAEs 3F2gMKgObSqcOZPRSM/Vt+F6QWIDVRWKM+RKBFII8s5FwTL252uLkLMZXd3vSkOya0C8RrHCZlT P8549Pj5VyPJq/v+R8dQxf84IH2wzAeDp+jFKkCIOaQ== X-Received: by 2002:a17:903:32ce:b0:2df:4876:50d9 with SMTP id d9443c01a7336-2eb0033f5c7mr43411365ad.18.1793263856778; Thu, 29 Oct 2026 01:50:56 -0700 (PDT) Received: from localhost.localdomain ([183.96.175.225]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2eae6bddae0sm29991205ad.35.2026.10.29.01.50.53 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 29 Oct 2026 01:50:56 -0700 (PDT) From: Joonho Lee To: linux-sound@vger.kernel.org Cc: tiwai@suse.de, perex@perex.cz, anton.yakovlev@opensynergy.com, mst@redhat.com, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, corbet@lwn.net, skhan@linuxfoundation.org, rdunlap@infradead.org, linux-doc@vger.kernel.org, Joonho Lee Subject: [PATCH v9 04/14] ALSA: virtio: Keep PCM DMA buffers alive through device ownership Date: Thu, 29 Oct 2026 17:50:22 +0900 Message-ID: <20261029085032.70689-5-mynameisjune111@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20261029085032.70689-1-mynameisjune111@gmail.com> References: <20261029085032.70689-1-mynameisjune111@gmail.com> X-Mailing-List: virtualization@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Retain references to the pages backing ALSA's vmalloc buffer until its queued I/O messages are freed. On NOMMU systems, use driver-owned memory for DMA and copy playback data before submission and capture data after completion, so ALSA buffer release cannot invalidate an active request. Validate the PCM buffer and each period before building scatterlists. Clamp device-reported capture lengths to the message capacity before advancing the hardware pointer, preventing an oversized completion from accounting bytes beyond the buffer actually submitted. Require whole-byte periods whose total matches the negotiated buffer. Check offset, length and the final message index before indexing the message array, including empty transfers and arithmetic wraparound. Fixes: f40a28679e0b ("ALSA: virtio: handling control and I/O messages for the PCM device") Assisted-by: LLM Signed-off-by: Joonho Lee --- diff --git a/sound/virtio/virtio_pcm.h b/sound/virtio/virtio_pcm.h --- a/sound/virtio/virtio_pcm.h +++ b/sound/virtio/virtio_pcm.h @@ -13,6 +13,7 @@ struct virtio_pcm; struct virtio_pcm_msg; +struct page; /** * struct virtio_pcm_substream - VirtIO PCM substream. @@ -38,6 +39,10 @@ * @msgs: Allocated I/O messages. * @nmsgs: Number of allocated I/O messages. * @msg_count: Number of pending I/O messages in the virtqueue. + * @dma_pages: Pages backing DMA messages, retained until messages are freed. + * @ndma_pages: Number of retained pages. + * @owned_dma_area: Driver-owned PCM buffer backing asynchronous messages. + * @owned_dma_bytes: Size of @owned_dma_area. * @msg_empty: Notify when msg_count is zero. */ struct virtio_pcm_substream { @@ -62,6 +67,12 @@ struct virtio_pcm_msg **msgs; unsigned int nmsgs; unsigned int msg_count; + struct page **dma_pages; + unsigned int ndma_pages; +#ifndef CONFIG_MMU + u8 *owned_dma_area; + size_t owned_dma_bytes; +#endif wait_queue_head_t msg_empty; }; diff --git a/sound/virtio/virtio_pcm_msg.c b/sound/virtio/virtio_pcm_msg.c --- a/sound/virtio/virtio_pcm_msg.c +++ b/sound/virtio/virtio_pcm_msg.c @@ -3,6 +3,9 @@ * virtio-snd: Virtio sound device * Copyright (C) 2021 OpenSynergy GmbH */ +#include +#include +#include #include #include "virtio_card.h" @@ -13,6 +16,7 @@ * @xfer: Request header payload. * @status: Response header payload. * @length: Data length in bytes. + * @data_offset: Offset in the driver-owned PCM buffer on NOMMU systems. * @sgs: Payload scatter-gather table. */ struct virtio_pcm_msg { @@ -20,6 +24,9 @@ struct virtio_snd_pcm_xfer xfer; struct virtio_snd_pcm_status status; size_t length; +#ifndef CONFIG_MMU + size_t data_offset; +#endif struct scatterlist sgs[]; }; @@ -37,9 +44,8 @@ }; /** - * virtsnd_pcm_sg_num() - Count the number of sg-elements required to represent - * vmalloc'ed buffer. - * @data: Pointer to vmalloc'ed buffer. + * virtsnd_pcm_sg_num() - Count the sg-elements for a page-backed buffer. + * @data: Pointer to the page-backed buffer. * @length: Buffer size. * * Context: Any context. @@ -47,14 +53,18 @@ */ static int virtsnd_pcm_sg_num(u8 *data, unsigned int length) { - phys_addr_t sg_address; - unsigned int sg_length; + phys_addr_t sg_address = 0; + unsigned int sg_length = 0; int num = 0; while (length) { struct page *pg = vmalloc_to_page(data); - phys_addr_t pg_address = page_to_phys(pg); + phys_addr_t pg_address; size_t pg_length; + + if (!pg) + return -EINVAL; + pg_address = page_to_phys(pg); pg_length = PAGE_SIZE - offset_in_page(data); if (pg_length > length) @@ -75,11 +85,80 @@ return num; } -/** - * virtsnd_pcm_sg_from() - Build sg-list from vmalloc'ed buffer. +#ifdef CONFIG_MMU +/** + * virtsnd_pcm_dma_pages_put() - Release retained PCM buffer pages. + * @vss: VirtIO PCM substream. + * + * Context: Process context. + */ +static void virtsnd_pcm_dma_pages_put(struct virtio_pcm_substream *vss) +{ + while (vss->ndma_pages) + put_page(vss->dma_pages[--vss->ndma_pages]); + kfree(vss->dma_pages); + vss->dma_pages = NULL; +} + +/** + * virtsnd_pcm_dma_pages_get() - Retain the pages backing the PCM buffer. + * @vss: VirtIO PCM substream. + * @data: PCM buffer address. + * @length: PCM buffer size. + * + * Keep the backing pages alive while virtqueue descriptors can still refer to + * them, even if ALSA releases the vmalloc mapping after a failed drain. + * + * Context: Process context. + * Return: 0 on success, -errno on failure. + */ +static int virtsnd_pcm_dma_pages_get(struct virtio_pcm_substream *vss, + u8 *data, size_t length) +{ + size_t i; + size_t npages; + size_t span; + + if (!data || !length || !is_vmalloc_addr(data)) + return -EINVAL; + if (vss->dma_pages || vss->ndma_pages) + return -EBUSY; + + if (check_add_overflow(length, (size_t)offset_in_page(data), &span)) + return -EOVERFLOW; + + npages = span / PAGE_SIZE + !!(span % PAGE_SIZE); + if (npages > UINT_MAX) + return -EOVERFLOW; + + vss->dma_pages = kcalloc(npages, sizeof(*vss->dma_pages), GFP_KERNEL); + if (!vss->dma_pages) + return -ENOMEM; + + for (i = 0; i < npages; i++) { + struct page *page = vmalloc_to_page(data + i * PAGE_SIZE); + + if (!page) + goto err_put_pages; + + get_page(page); + vss->dma_pages[vss->ndma_pages++] = page; + } + + return 0; + +err_put_pages: + virtsnd_pcm_dma_pages_put(vss); + + return -EINVAL; +} +#endif + +/** + * virtsnd_pcm_sg_from() - Build an sg-list from a page-backed buffer. * @sgs: Preallocated sg-list to populate. * @nsgs: The maximum number of elements in the @sgs. - * @data: Pointer to vmalloc'ed buffer. + * @data: Pointer to the page-backed buffer. * @length: Buffer size. * * Splits the buffer into physically contiguous parts and makes an sg-list of @@ -132,36 +211,99 @@ int virtsnd_pcm_msg_alloc(struct virtio_pcm_substream *vss, unsigned int periods, unsigned int period_bytes) { - struct snd_pcm_runtime *runtime = vss->substream->runtime; + struct snd_pcm_runtime *runtime; + size_t buffer_bytes; unsigned int i; + int rc; + + if (vss->msgs || vss->nmsgs || vss->dma_pages || vss->ndma_pages) + return -EBUSY; +#ifndef CONFIG_MMU + if (vss->owned_dma_area || vss->owned_dma_bytes) + return -EBUSY; +#endif + if (!periods || !period_bytes) + return -EINVAL; + + if (check_mul_overflow((size_t)periods, (size_t)period_bytes, + &buffer_bytes)) + return -EOVERFLOW; + + if (!vss->substream || !vss->substream->runtime) + return -EINVAL; + runtime = vss->substream->runtime; + if (!runtime->dma_area || buffer_bytes > runtime->dma_bytes) + return -EINVAL; + +#ifdef CONFIG_MMU + rc = virtsnd_pcm_dma_pages_get(vss, runtime->dma_area, buffer_bytes); + if (rc) + return rc; +#else + vss->owned_dma_area = kzalloc(buffer_bytes, GFP_KERNEL); + if (!vss->owned_dma_area) + return -ENOMEM; + vss->owned_dma_bytes = buffer_bytes; +#endif vss->msgs = kzalloc_objs(*vss->msgs, periods); - if (!vss->msgs) - return -ENOMEM; + if (!vss->msgs) { + rc = -ENOMEM; + goto err_free_pages; + } vss->nmsgs = periods; for (i = 0; i < periods; ++i) { - u8 *data = runtime->dma_area + period_bytes * i; - int sg_num = virtsnd_pcm_sg_num(data, period_bytes); + int sg_num; struct virtio_pcm_msg *msg; + u8 *data; +#ifdef CONFIG_MMU + data = runtime->dma_area + (size_t)period_bytes * i; +#else + data = vss->owned_dma_area + (size_t)period_bytes * i; +#endif + sg_num = virtsnd_pcm_sg_num(data, period_bytes); + if (sg_num < 0) { + rc = sg_num; + goto err_free_msgs; + } msg = kzalloc_flex(*msg, sgs, sg_num + 2); - if (!msg) - return -ENOMEM; + if (!msg) { + rc = -ENOMEM; + goto err_free_msgs; + } msg->substream = vss; + vss->msgs[i] = msg; sg_init_one(&msg->sgs[PCM_MSG_SG_XFER], &msg->xfer, sizeof(msg->xfer)); sg_init_one(&msg->sgs[PCM_MSG_SG_STATUS], &msg->status, sizeof(msg->status)); +#ifndef CONFIG_MMU + msg->data_offset = (size_t)period_bytes * i; +#endif virtsnd_pcm_sg_from(&msg->sgs[PCM_MSG_SG_DATA], sg_num, data, period_bytes); - - vss->msgs[i] = msg; } return 0; + +err_free_msgs: + virtsnd_pcm_msg_free(vss); + return rc; + +err_free_pages: +#ifdef CONFIG_MMU + virtsnd_pcm_dma_pages_put(vss); +#else + kfree(vss->owned_dma_area); + vss->owned_dma_area = NULL; + vss->owned_dma_bytes = 0; +#endif + + return rc; } /** @@ -177,6 +319,13 @@ for (i = 0; vss->msgs && i < vss->nmsgs; ++i) kfree(vss->msgs[i]); kfree(vss->msgs); +#ifdef CONFIG_MMU + virtsnd_pcm_dma_pages_put(vss); +#else + kfree(vss->owned_dma_area); + vss->owned_dma_area = NULL; + vss->owned_dma_bytes = 0; +#endif vss->msgs = NULL; vss->nmsgs = 0; @@ -228,8 +377,15 @@ bool notify = false; int rc; + if (!bytes) + return 0; + if (!period_bytes || !vss->msgs || offset >= vss->buffer_bytes || + bytes > vss->buffer_bytes - offset) + return -EINVAL; start = offset / period_bytes; end = (offset + bytes - 1) / period_bytes; + if (end >= vss->nmsgs) + return -EINVAL; for (i = start; i <= end; i++) { struct virtio_pcm_msg *msg = vss->msgs[i]; @@ -248,6 +404,33 @@ if (msg->length == period_bytes) { msg->xfer.stream_id = cpu_to_le32(vss->sid); memset(&msg->status, 0, sizeof(msg->status)); + +#ifndef CONFIG_MMU + if (vss->direction == SNDRV_PCM_STREAM_PLAYBACK) { + struct snd_pcm_runtime *runtime = + vss->substream ? vss->substream->runtime : NULL; + size_t data_bytes = msg->length; + + if (!runtime || !runtime->dma_area || !vss->owned_dma_area || + msg->data_offset > runtime->dma_bytes || + data_bytes > runtime->dma_bytes - msg->data_offset || + msg->data_offset > vss->owned_dma_bytes || + data_bytes > vss->owned_dma_bytes - msg->data_offset) { + dev_err_ratelimited(&vdev->dev, + "SID %u: invalid playback buffer for I/O message\n", + vss->sid); + msg->length -= n; + if (msg_count != vss->msg_count && + !(vss->features & + (1U << VIRTIO_SND_PCM_F_MSG_POLLING)) && + virtqueue_kick_prepare(vqueue)) + virtqueue_notify(vqueue); + return -EINVAL; + } + memcpy(vss->owned_dma_area + msg->data_offset, + runtime->dma_area + msg->data_offset, data_bytes); + } +#endif if (vss->direction == SNDRV_PCM_STREAM_PLAYBACK) rc = virtqueue_add_sgs(vqueue, psgs, 2, 1, msg, @@ -363,15 +546,48 @@ * the hw_ptr value is unconditionally advanced. */ guard(spinlock)(&vss->lock); +#ifndef CONFIG_MMU + if (vss->direction == SNDRV_PCM_STREAM_CAPTURE && + vss->xfer_enabled && written_bytes > sizeof(msg->status)) { + struct snd_pcm_runtime *runtime = + vss->substream ? vss->substream->runtime : NULL; + size_t reported_bytes = written_bytes - sizeof(msg->status); + size_t data_bytes = min_t(size_t, reported_bytes, msg->length); + + if (!runtime || !runtime->dma_area || !vss->owned_dma_area || + msg->data_offset > runtime->dma_bytes || + data_bytes > runtime->dma_bytes - msg->data_offset || + msg->data_offset > vss->owned_dma_bytes || + data_bytes > vss->owned_dma_bytes - msg->data_offset) + dev_err_ratelimited(&vss->snd->vdev->dev, + "SID %u: invalid capture buffer for I/O message\n", + vss->sid); + else + memcpy(runtime->dma_area + msg->data_offset, + vss->owned_dma_area + msg->data_offset, data_bytes); + } +#endif + if (vss->direction == SNDRV_PCM_STREAM_CAPTURE && + written_bytes > sizeof(msg->status) && + written_bytes - sizeof(msg->status) > msg->length) + dev_err_ratelimited(&vss->snd->vdev->dev, + "SID %u: capture length exceeds I/O message capacity\n", + vss->sid); /* * If the capture substream returned an incorrect status, then just - * increase the hw_ptr by the message size. + * increase the hw_ptr by the message size. Clamp valid capture lengths to + * the actual SG payload capacity before accounting them. */ if (vss->direction == SNDRV_PCM_STREAM_PLAYBACK || - written_bytes <= sizeof(msg->status)) + written_bytes <= sizeof(msg->status)) { vss->hw_ptr += msg->length; - else - vss->hw_ptr += written_bytes - sizeof(msg->status); + } else { + size_t data_bytes = min_t(size_t, + written_bytes - sizeof(msg->status), + msg->length); + + vss->hw_ptr += data_bytes; + } if (vss->hw_ptr >= vss->buffer_bytes) vss->hw_ptr -= vss->buffer_bytes; @@ -387,7 +603,6 @@ runtime->delay = bytes_to_frames(runtime, le32_to_cpu(msg->status.latency_bytes)); - schedule_work(&vss->elapsed_period); } else if (!vss->msg_count) { wake_up_all(&vss->msg_empty); diff --git a/sound/virtio/virtio_pcm_ops.c b/sound/virtio/virtio_pcm_ops.c --- a/sound/virtio/virtio_pcm_ops.c +++ b/sound/virtio/virtio_pcm_ops.c @@ -25,6 +25,8 @@ * signal or due to a timeout. In this case, the device can still access * messages even after calling ops->hw_free(). It can also issue an interrupt, * and the interrupt handler will also try to access message structures. + * The messages retain references to the PCM buffer pages until they are + * freed, so late DMA does not target pages released by ALSA. * * Therefore, freeing of already allocated messages occurs: * @@ -228,8 +230,19 @@ struct virtio_pcm_substream *vss = snd_pcm_substream_chip(substream); struct virtio_device *vdev = vss->snd->vdev; unsigned int msg_count; + size_t period_buffer_bytes; bool stopped; int rc; + + /* Fixed descriptors require whole-byte periods covering the buffer. */ + if (check_mul_overflow((size_t)params_periods(hw_params), + (size_t)params_period_bytes(hw_params), + &period_buffer_bytes) || + period_buffer_bytes != params_buffer_bytes(hw_params) || + (params_period_size(hw_params) * + (u64)snd_pcm_format_physical_width(params_format(hw_params)) * + params_channels(hw_params)) % 8) + return -EINVAL; scoped_guard(spinlock_irqsave, &vss->lock) { msg_count = vss->msg_count;