From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DA44C433EF for ; Fri, 8 Oct 2021 11:12:37 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5036E61027 for ; Fri, 8 Oct 2021 11:12:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 5036E61027 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=suse.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=alsa-project.org Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 0F32D1666; Fri, 8 Oct 2021 13:11:44 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 0F32D1666 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1633691554; bh=K69UDP8s6GeutQ4CjF/1z/Js06UOh3yCxtYPGzR3+eg=; h=Date:From:To:Subject:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=Lu+ZFltBMuN0Hr52NA69Mqpj7K5fAD0dtQ2msc0ZDCNUl/QYrn0cOA6EFmueg6OPm RIVk6CZLKq3lQRYfc23SFqlVKf5hvnPdofKu9Wm1e/MtyXA0N6R4WevQON7LofxzXc C/AGWzj+jL3aGPtREezplULptgKlmRxJcrbIsGt4= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 88924F80240; Fri, 8 Oct 2021 13:11:43 +0200 (CEST) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 4564DF80246; Fri, 8 Oct 2021 13:11:42 +0200 (CEST) Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 7F99DF80229 for ; Fri, 8 Oct 2021 13:11:35 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 7F99DF80229 Authentication-Results: alsa1.perex.cz; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.b="vEIc5DFA"; dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de header.b="w0jP95IY" Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out2.suse.de (Postfix) with ESMTP id B00671FD50; Fri, 8 Oct 2021 11:11:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1633691494; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=6AllT7vFzlj3+aDBdf/yiqJk0GTLCdskUqPHL1yGT/g=; b=vEIc5DFA38wtbN7RozvqpEexugI9p6NT8gX45nodD1zlOEm2nah1q4fTt75x9ohzFd8BTc iGOgVtXrgiWLwuCWT9ZKYPo7EIKtL1HoFqMleMPg0rf/suzslUONEJGDbsNczxrNV028aD kR/9skwLpcX9MOvVlmmnzJV96SqS2ec= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1633691494; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=6AllT7vFzlj3+aDBdf/yiqJk0GTLCdskUqPHL1yGT/g=; b=w0jP95IYdM7DQbzexQf4CdbSapatKzu8wUv1BoDYWnA5XPM9BiRo5NaqhXuCFkqUzl/vSx Sfmsln3YowgqvDDg== Received: from alsa1.suse.de (alsa1.suse.de [10.160.4.42]) by relay2.suse.de (Postfix) with ESMTP id 7EF49A3B83; Fri, 8 Oct 2021 11:11:34 +0000 (UTC) Date: Fri, 08 Oct 2021 13:11:34 +0200 Message-ID: From: Takashi Iwai To: Arnd Bergmann Subject: Re: [musl] Re: [alsa-devel] [PATCH v7 8/9] ALSA: add new 32-bit layout for snd_pcm_mmap_status/control In-Reply-To: References: <20191211212025.1981822-1-arnd@arndb.de> <20191211212025.1981822-9-arnd@arndb.de> <29QBMJU8DE71E.2YZSH8IHT5HMH@mforney.org> <20211007160634.GB7074@brightrain.aerifal.cx> <20211007165158.GC7074@brightrain.aerifal.cx> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: ALSA Development Mailing List , Rich Felker , Baolin Wang , y2038 Mailman List , Linux Kernel Mailing List , musl@lists.openwall.com, Takashi Iwai , Michael Forney , Mark Brown , Baolin Wang X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" On Fri, 08 Oct 2021 11:24:39 +0200, Arnd Bergmann wrote: > > On Fri, Oct 8, 2021 at 10:43 AM Takashi Iwai wrote: > > On Thu, 07 Oct 2021 18:51:58 +0200, Rich Felker wrote: > > > On Thu, Oct 07, 2021 at 06:18:52PM +0200, Takashi Iwai wrote: > > > > @@ -557,11 +558,15 @@ struct __snd_pcm_sync_ptr { > > #if defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN) > > typedef char __pad_before_uframe[sizeof(__u64) - sizeof(snd_pcm_uframes_t)]; > > typedef char __pad_after_uframe[0]; > > +typedef char __pad_before_u32[4]; > > +typedef char __pad_after_u32[0]; > > #endif > > > > #if defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN) > > typedef char __pad_before_uframe[0]; > > typedef char __pad_after_uframe[sizeof(__u64) - sizeof(snd_pcm_uframes_t)]; > > +typedef char __pad_before_u32[0]; > > +typedef char __pad_after_u32[4]; > > #endif > > I think these should remain unchanged, the complex expression was intentionally > done so the structures are laid out the same way on 64-bit > architectures, so that > the kernel can use the __SND_STRUCT_TIME64 path internally on both 32-bit > and 64-bit architectures. That was explicitly defined, but OK, this isn't necessarily defined here. > > @@ -2970,8 +2981,17 @@ static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream, > > memset(&sync_ptr, 0, sizeof(sync_ptr)); > > if (get_user(sync_ptr.flags, (unsigned __user *)&(_sync_ptr->flags))) > > return -EFAULT; > > - if (copy_from_user(&sync_ptr.c.control, &(_sync_ptr->c.control), sizeof(struct snd_pcm_mmap_control))) > > - return -EFAULT; > > + if (buggy_control) { > > + if (copy_from_user(&sync_ptr.c.control_api_2_0_15, > > + &(_sync_ptr->c.control_api_2_0_15), > > + sizeof(sync_ptr.c.control_api_2_0_15))) > > + return -EFAULT; > > + } else { > > + if (copy_from_user(&sync_ptr.c.control, > > + &(_sync_ptr->c.control), > > + sizeof(sync_ptr.c.control))) > > + return -EFAULT; > > + } > > The problem I see with this is that it might break musl's ability to > emulate the new > interface on top of the old (time32) one for linux-4.x and older > kernels, as the conversion > function is no longer stateless but has to know the negotiated > interface version. > > It's probably fine as long as we can be sure that the 2.0.16+ API > version only gets > negotiated if both the kernel and user sides support it, and musl only emulates > the 2.0.15 API version from the current kernels. > > I've tried to understand this part of musl's convert_ioctl_struct(), but I just > can't figure out whether it does the conversion based the on the layout that > is currently used in the kernel, or based on the layout we should have been > using, and would use with the above fix. Rich, can you help me here? So, at this moment, I'm not sure whether we should correct the struct at all. This will lead to yet more breakage, and basically the struct itself *works* -- the only bug is in 32bit compat handling in the kernel (again). The below is a revised kernel patch (again untested), just correcting the behavior of 32bit compat mode. 32bit apps on 32bit kernel work fine as is, as well as 64bit apps on 64bit kernel. Takashi --- a/sound/core/pcm_compat.c +++ b/sound/core/pcm_compat.c @@ -468,6 +468,75 @@ static int snd_pcm_ioctl_sync_ptr_x32(struct snd_pcm_substream *substream, } #endif /* CONFIG_X86_X32 */ +#ifdef __BIG_ENDIAN +typedef char __pad_before_u32[4]; +typedef char __pad_after_u32[0]; +#else +typedef char __pad_before_u32[0]; +typedef char __pad_after_u32[4]; +#endif + +/* PCM 2.0.15 API definition had a bug in mmap control; it puts the avail_min + * at the wrong offset due to a typo in padding type, hitting only on 32bit. + * Workaround for incorrect read/write is needed only in 32bit compat mode. + */ +struct __snd_pcm_mmap_control64_buggy { + __pad_before_u32 __pad1; + __u32 appl_ptr; + __pad_before_u32 __pad2; /* SiC! here is the bug */ + __pad_before_u32 __pad3; + __u32 avail_min; + __pad_after_uframe __pad4; +}; + +static int snd_pcm_ioctl_sync_ptr_buggy(struct snd_pcm_substream *substream, + struct snd_pcm_sync_ptr __user *_sync_ptr) +{ + struct snd_pcm_runtime *runtime = substream->runtime; + struct snd_pcm_sync_ptr sync_ptr; + struct __snd_pcm_mmap_control64_buggy *sync_cp; + volatile struct snd_pcm_mmap_status *status; + volatile struct snd_pcm_mmap_control *control; + int err; + + memset(&sync_ptr, 0, sizeof(sync_ptr)); + sync_cp = (struct __snd_pcm_mmap_control64_buggy *)&sync_ptr.c.control; + if (get_user(sync_ptr.flags, (unsigned __user *)&(_sync_ptr->flags))) + return -EFAULT; + if (copy_from_user(sync_cp, &(_sync_ptr->c.control), sizeof(*sync_cp))) + return -EFAULT; + status = runtime->status; + control = runtime->control; + if (sync_ptr.flags & SNDRV_PCM_SYNC_PTR_HWSYNC) { + err = snd_pcm_hwsync(substream); + if (err < 0) + return err; + } + snd_pcm_stream_lock_irq(substream); + if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_APPL)) { + err = pcm_lib_apply_appl_ptr(substream, sync_cp->appl_ptr); + if (err < 0) { + snd_pcm_stream_unlock_irq(substream); + return err; + } + } else { + sync_cp->appl_ptr = control->appl_ptr; + } + if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_AVAIL_MIN)) + control->avail_min = sync_cp->avail_min; + else + sync_cp->avail_min = control->avail_min; + sync_ptr.s.status.state = status->state; + sync_ptr.s.status.hw_ptr = status->hw_ptr; + sync_ptr.s.status.tstamp = status->tstamp; + sync_ptr.s.status.suspended_state = status->suspended_state; + sync_ptr.s.status.audio_tstamp = status->audio_tstamp; + snd_pcm_stream_unlock_irq(substream); + if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr))) + return -EFAULT; + return 0; +} + /* */ enum { @@ -537,7 +606,7 @@ static long snd_pcm_ioctl_compat(struct file *file, unsigned int cmd, unsigned l if (in_x32_syscall()) return snd_pcm_ioctl_sync_ptr_x32(substream, argp); #endif /* CONFIG_X86_X32 */ - return snd_pcm_common_ioctl(file, substream, cmd, argp); + return snd_pcm_ioctl_sync_ptr_buggy(substream, argp); case SNDRV_PCM_IOCTL_HW_REFINE32: return snd_pcm_ioctl_hw_params_compat(substream, 1, argp); case SNDRV_PCM_IOCTL_HW_PARAMS32: