A failed PCM start or a timed-out request can leave virtio-snd messages owned by the device after the caller returns. Retrying can then reuse pending messages, and freeing ALSA or control buffers can leave their addresses in a virtqueue.
This series fixes enqueue-error recovery and keeps the memory referenced by outstanding requests alive until completion or device reset. Reset also detaches unused descriptors before deleting the queues, releasing their DMA mappings and cancelling PCM messages without reporting them as completed audio. Changes since v1, following the Sashiko AI review: - Patch 1 propagates enqueue failures through ACK. Indirect PCM state is committed only on success; a failed transfer stops the stream and returns -EPIPE rather than allowing an out-of-sync retry. - Patch 2 is unchanged. - Patch 3 detaches unused descriptors on all queues after reset and balances PCM cancellation and control-message references. - Patch 4 supports NOMMU with an owned, zeroed buffer instead of rejecting an ordinary kmalloc-backed ALSA buffer. Capture copies are bounded and disabled once the stream stops. - Patch 5 separates CPU metadata from DMA storage and aligns each DMA region to dma_get_cache_alignment(). Control-send cleanup also uses explicit, balanced locking instead of mixing scoped guards and gotos. Validation of the final source: - Source-extracted ASan/UBSan regressions on macOS arm64 and Linux arm64, including expected failures on the v1 ACK and NOMMU implementations. - ARM64 W=1 module builds at all five patch steps, plus an ARM32 CONFIG_MMU=n driver object build of the final source. - QEMU ARM64 KASAN tests with delayed PCM completion past hw_free, delayed PCM_INFO completion after timeout, and reset with pending control requests. Each case includes a subsequent recovery operation. The QEMU tests use a synthetic audio backend; they do not validate a host microphone. NOMMU coverage is a compile and source-extracted test, not a booted NOMMU guest. Cache-alignment checks are not a physical non-coherent DMA hardware test. Reproducer source and instructions, pinned to the tested revision: https://github.com/whatisyourname0/virtio-snd-reproducer/tree/ef97b69baea51d952ddd7c329a1894150f41849e The reproducer currently obtains the same final driver source by applying the archived v1 patches plus review-v2.diff. Its full kernel/QEMU rebuild recipe has not been rerun end to end; the reported runtime tests used rebuilt candidate modules with the existing matching KASAN kernel image. Based on sound.git for-next commit 8d70e364e866bdfca81eee24d0688fac9472cfb9. AI assistance was used for code changes, test harnesses, review, and patch text. The Sashiko findings were checked against the driver and reproduced where applicable before incorporating the fixes. Assisted-by trailers are included in the patches. Previous series Message-ID: <[email protected]> Joonho Lee (5): ALSA: virtio: Propagate PCM send failures through ACK ALSA: virtio: Recover PCM state after a failed start ALSA: virtio: Retain queued messages through device reset ALSA: virtio: Keep PCM DMA buffers alive through device ownership ALSA: virtio: Keep control payloads alive through DMA completion sound/virtio/virtio_card.c | 44 ++++- sound/virtio/virtio_card.h | 2 + sound/virtio/virtio_ctl_msg.c | 305 +++++++++++++++++++++++++++------- sound/virtio/virtio_ctl_msg.h | 28 +++- sound/virtio/virtio_kctl.c | 104 ++++++------ sound/virtio/virtio_pcm.h | 13 ++ sound/virtio/virtio_pcm_msg.c | 295 +++++++++++++++++++++++++++++--- sound/virtio/virtio_pcm_ops.c | 147 +++++++++++++--- 8 files changed, 780 insertions(+), 158 deletions(-) base-commit: 8d70e364e866bdfca81eee24d0688fac9472cfb9 -- 2.54.0 (Apple Git-157)
