linux-kernel - Re: [PATCH 3/3] ALSA: qc_audio_offload: try to reduce address space confusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <246834be-9e72-432e-86e4-e1c68262e710@app.fastmail.com>
Date: Fri, 05 Sep 2025 14:08:25 +0200
From: "Arnd Bergmann" <arnd@...db.de>
To: "Luca Weiss" <luca.weiss@...rphone.com>, "Takashi Iwai" <tiwai@...e.de>
Cc: "Arnd Bergmann" <arnd@...nel.org>, "Mark Brown" <broonie@...nel.org>,
 "Wesley Cheng" <quic_wcheng@...cinc.com>, "Jaroslav Kysela" <perex@...ex.cz>,
 "Takashi Iwai" <tiwai@...e.com>,
 "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
 "Dan Carpenter" <dan.carpenter@...aro.org>, linux-sound@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/3] ALSA: qc_audio_offload: try to reduce address space confusion

On Fri, Sep 5, 2025, at 13:47, Luca Weiss wrote:
> On Fri Aug 1, 2025 at 2:49 PM CEST, Takashi Iwai wrote:
>> On Fri, 01 Aug 2025 14:35:27 +0200,
>>> On Fri Aug 1, 2025 at 2:31 PM CEST, Takashi Iwai wrote:
>>> > On Fri, 01 Aug 2025 13:31:42 +0200,
>>> >> On Tue May 13, 2025 at 2:34 PM CEST, Arnd Bergmann wrote:
>>> >> >
>>> >> > Make this more explicit by pulling the conversion out first
>>> >> > and warning if it is not part of the linear map, and using the
>>> >> > actual physical address to map into the iommu in place of the
>>> >> > dma address that may already be iommu-mapped into the usb host.
>>> >> 
>>> >> This patch is breaking USB audio offloading on Qualcomm devices on 6.16,
>>> >> as tested on sm6350 and sc7280-based smartphones.
>>> >> 
>>> >> Let me know if I can be of any help to resolve this.
>>> >
>>> > I guess just dropping WARN_ON() would help?
>>> >
>>> > As far as I read the code, pa argument isn't used at all in
>>> > uaudio_iommu_map() unless as sgt is NULL.  In this case, sgt is never
>>> > NULL, hence the pa argument is just a placeholder.
>>> > That said, the whole xfer_buf_pa (and its sanity check) can be dropped
>>> > there.
>>> 
>>> Just the WARN splat is not the problem, it's actually failing
>>> afterwards. Without the patch it works as expected.
>>
>> That is, replace WARN_ON() with 0.
>>
>> 	if (0 /*WARN_ON(!page_is_ram(PFN_DOWN(xfer_buf_pa)))*/) {
>> 		ret = -ENXIO;
>> 		goto unmap_sync;
>> 	}
>
> Yes, that appears to work fine as well. Playback works again.
>

This does mean that the address returned from xfer_buf is not
a kernel address in the virtual map though, and converting it
through virt_to_phys() makes the pa undefined for
uaudio_iommu_map(). Can you print what that pa value
is that you get here, and where that sits in the address space?

    Arnd