On SNDRV_PCM_TRIGGER_START event, audio data pointers are not reset.

This leads to wrong data buffer usage when multiple TRIGGER_START are
received and ends to incorrect buffer usage between the user-space and
the driver. Indeed, the driver can read data that are not already set by
the user-space or the user-space and the driver are writing and reading
the same area.

Fix that resetting data pointers on each SNDRV_PCM_TRIGGER_START events.

Fixes: 075c7125b11c ("ASoC: fsl: Add support for QMC audio")
Cc: stable@vger.kernel.org
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
---
 sound/soc/fsl/fsl_qmc_audio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/soc/fsl/fsl_qmc_audio.c b/sound/soc/fsl/fsl_qmc_audio.c
index b2979290c973..5614a8b909ed 100644
--- a/sound/soc/fsl/fsl_qmc_audio.c
+++ b/sound/soc/fsl/fsl_qmc_audio.c
@@ -250,6 +250,9 @@ static int qmc_audio_pcm_trigger(struct snd_soc_component *component,
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
 		bitmap_zero(prtd->chans_pending, 64);
+		prtd->buffer_ended = 0;
+		prtd->ch_dma_addr_current = prtd->ch_dma_addr_start;
+
 		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
 			for (i = 0; i < prtd->channels; i++)
 				prtd->qmc_dai->chans[i].prtd_tx = prtd;
-- 
2.49.0

On Thu, 10 Apr 2025 11:16:43 +0200, Herve Codina wrote:
> On SNDRV_PCM_TRIGGER_START event, audio data pointers are not reset.
> 
> This leads to wrong data buffer usage when multiple TRIGGER_START are
> received and ends to incorrect buffer usage between the user-space and
> the driver. Indeed, the driver can read data that are not already set by
> the user-space or the user-space and the driver are writing and reading
> the same area.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/1] ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event
      commit: 9aa33d5b4a53a1945dd2aee45c09282248d3c98b

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

Hi Mark,


Le 10/04/2025 à 15:47, Mark Brown a écrit :
> On Thu, 10 Apr 2025 11:16:43 +0200, Herve Codina wrote:
>> On SNDRV_PCM_TRIGGER_START event, audio data pointers are not reset.
>>
>> This leads to wrong data buffer usage when multiple TRIGGER_START are
>> received and ends to incorrect buffer usage between the user-space and
>> the driver. Indeed, the driver can read data that are not already set by
>> the user-space or the user-space and the driver are writing and reading
>> the same area.
>>
>> [...]
> 
> Applied to
> 
>     https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.kernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Fbroonie%2Fsound.git&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C438de093b4c04d4c0a8f08dd78362e30%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C638798896267382068%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=d%2FuL%2FFAOcpRY2v9YtxTMdiX%2B3GgHKDE7y5TMTc9cK94%3D&reserved=0 for-next

Would it be possible to get this patch into one of the v6.15 rc as it is 
a bug fix ?

Thanks
Christophe

> 
> Thanks!
> 
> [1/1] ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event
>        commit: 9aa33d5b4a53a1945dd2aee45c09282248d3c98b
> 
> All being well this means that it will be integrated into the linux-next
> tree (usually sometime in the next 24 hours) and sent to Linus during
> the next merge window (or sooner if it is a bug fix), however if
> problems are discovered then the patch may be dropped or reverted.
> 
> You may get further e-mails resulting from automated or manual testing
> and review of the tree, please engage with people reporting problems and
> send followup patches addressing any issues that are reported if needed.
> 
> If any updates are required or you are submitting further changes they
> should be sent as incremental updates against current git, existing
> patches will not be replaced.
> 
> Please add any relevant lists and maintainers to the CCs when replying
> to this mail.
> 
> Thanks,
> Mark
> 

On Mon, Apr 28, 2025 at 11:20:42AM +0200, Christophe Leroy wrote:
> Le 10/04/2025 à 15:47, Mark Brown a écrit :

> Would it be possible to get this patch into one of the v6.15 rc as it is a
> bug fix ?

It appears to be queued as a fix, could you be more specific please?

Please delete unneeded context from mails when replying.  Doing this
makes it much easier to find your reply in the message, helping ensure
it won't be missed by people scrolling through the irrelevant quoted
material.

Le 30/04/2025 à 02:23, Mark Brown a écrit :
> On Mon, Apr 28, 2025 at 11:20:42AM +0200, Christophe Leroy wrote:
>> Le 10/04/2025 à 15:47, Mark Brown a écrit :
> 
>> Would it be possible to get this patch into one of the v6.15 rc as it is a
>> bug fix ?
> 
> It appears to be queued as a fix, could you be more specific please?
> 


Maybe I misunderstood. You said applied to ... for-next, so I thought it 
was for v6.16.
If it goes into one of v6.15rc as a fix it is fine for me.

Thanks
Christophe

Le 10/04/2025 à 11:16, Herve Codina a écrit :
> On SNDRV_PCM_TRIGGER_START event, audio data pointers are not reset.
> 
> This leads to wrong data buffer usage when multiple TRIGGER_START are
> received and ends to incorrect buffer usage between the user-space and
> the driver. Indeed, the driver can read data that are not already set by
> the user-space or the user-space and the driver are writing and reading
> the same area.
> 
> Fix that resetting data pointers on each SNDRV_PCM_TRIGGER_START events.
> 
> Fixes: 075c7125b11c ("ASoC: fsl: Add support for QMC audio")
> Cc: stable@vger.kernel.org
> Signed-off-by: Herve Codina <herve.codina@bootlin.com>


Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>


Tested-by: Christophe Leroy <christophe.leroy@csgroup.eu>



> ---
>   sound/soc/fsl/fsl_qmc_audio.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/sound/soc/fsl/fsl_qmc_audio.c b/sound/soc/fsl/fsl_qmc_audio.c
> index b2979290c973..5614a8b909ed 100644
> --- a/sound/soc/fsl/fsl_qmc_audio.c
> +++ b/sound/soc/fsl/fsl_qmc_audio.c
> @@ -250,6 +250,9 @@ static int qmc_audio_pcm_trigger(struct snd_soc_component *component,
>   	switch (cmd) {
>   	case SNDRV_PCM_TRIGGER_START:
>   		bitmap_zero(prtd->chans_pending, 64);
> +		prtd->buffer_ended = 0;
> +		prtd->ch_dma_addr_current = prtd->ch_dma_addr_start;
> +
>   		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
>   			for (i = 0; i < prtd->channels; i++)
>   				prtd->qmc_dai->chans[i].prtd_tx = prtd;