Re: [PATCH RESEND] ALSA: usb-audio: qcom: Check offload mapping failures

[Takashi Iwai]

On Mon, 11 May 2026 06:36:37 +0200,
Cássio Gabriel wrote:
> 
> uaudio_transfer_buffer_setup() calls dma_get_sgtable() and then passes
> the sg_table to uaudio_iommu_map_xfer_buf() without checking whether sg
> table construction succeeded. If dma_get_sgtable() fails, the sg_table
> contents are not valid.
> 
> uaudio_iommu_map_pa() also ignores iommu_map() failures for the event and
> transfer rings and still returns the allocated IOVA to the QMI response.
> That can expose an unmapped IOVA to the audio DSP. For transfer rings,
> the failed mapping also leaves the IOVA allocator state marked in use.
> 
> Check both operations. Free the coherent transfer buffer when sg table
> construction fails, free the sg table when transfer-buffer IOMMU mapping
> fails, and release the transfer-ring IOVA if iommu_map() fails. Also
> return the existing event-ring IOVA when the event ring is already mapped,
> matching the pre-split helper behavior.
> 
> Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support")
> Fixes: 44499ecb4f28 ("ALSA: usb: qcom: Fix false-positive address space check")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@xxxxxxxxx>

Applied now.  Thanks.


Takashi