Thread index · Date index · Mailing lists
Branch: refs/heads/stable/4.0\n Home: https://github.com/MidnightBSD/src\n Commit: 45cc4ec65770c12c7c8fe5d97d5f621a64857c12\n https://github.com/MidnightBSD/src/commit/45cc4ec65770c12c7c8fe5d97d5f621a64857c12\n Author: Mark Johnston <markj@FreeBSD.org>\n Date: 2026-10-14 (Wed, 14 Oct 2026)\n\n Changed paths:\n M sys/dev/sound/pcm/buffer.c\n M sys/dev/sound/pcm/channel.c\n M tests/sys/sound/mmap.c\n\n Log Message:\n -----------\n sound: Revalidate after reacquiring locks when resizing buffers\n\nsndbuf_resize() and sndbuf_remalloc() drop the channel lock in order to\nallocate the new buffer(s) with M_WAITOK. Before doing that they verify\nthat the buffer is not mapped, but this could change while the lock is\ndropped, as there is no higher-level synchronization which prevents\nbuffer resize (e.g., via the SNDCTL_DSP_SETBLKSIZE ioctl) from happening\nconcurrently with mmap. Thus, these checks are insufficient.\n\nModify sndbuf_resize() and sndbuf_remalloc() to revalidate after\nreacquiring the lock. Extend them to check for a couple of channel\nflags, mirroring the check in chn_resizebuf(). Modify chn_resizebuf()\nto revalidate state after reacquiring the channel lock.\n\nWe could also allocate new buffers with M_NOWAIT and so avoid dropping\nthe lock. Then, I think we could go even further and invoke\nCHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS with the channel lock\nheld. But really it would be better to ensure that dsp operations are\nserialized; there is no reason for mmap and chn_resizebuf() to be able\nto run in parallel, we should not be relying on the channel lock for\nthis. So, let's keep a more minimal approach here.\n\nAdd a simple regression test.\n\nApproved by:\tso\nSecurity:\tFreeBSD-SA-26:71.sound\nSecurity:\tCVE-2026-101308\nSponsored by:\tThe FreeBSD Foundation\nDifferential Revision:\thttps://reviews.freebsd.org/D60554\n\n(cherry picked from FreeBSD commit d3b8957e2a8236c3c00401ed33bfe65eac9d9f62;\n adapted: sndbuf_remalloc() context differs, and the new test case\n uses open_dsp0() instead of requiring snd_dummy, which MidnightBSD\n does not have)\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n Commit: 78c6300d6968fb339a087574334ef30251102101\n https://github.com/MidnightBSD/src/commit/78c6300d6968fb339a087574334ef30251102101\n Author: Lucas Holt <luke@foolishgames.com>\n Date: 2026-10-14 (Wed, 14 Oct 2026)\n\n Changed paths:\n M UPDATING\n\n Log Message:\n -----------\n UPDATING: sound SA-26:71\n\nRecord the sound(4) fix from FreeBSD-SA-26:71.sound.\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\nCompare: https://github.com/MidnightBSD/src/compare/deeb6e2d0d7b...78c6300d6968\n\nTo unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications\n\nMidnightbsd-cvs\nmidnightbsd-cvs@midnightbsd.org\nTo unsubscribe: midnightbsd-cvs+unsubscribe@midnightbsd.org\nhttps://lists.midnightbsd.org/\n