[Bug 267555] mmap of dsp device fails if sound buffer is not a multiple of page size

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267555

            Bug ID: 267555
           Summary: mmap of dsp device fails if sound buffer is not a
                    multiple of page size
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: dev@submerge.ch

Created attachment 237855
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=237855&action=edit
Fix the length check for mmap of the dsp sound buffer

For some sound cards, the system call mmap(2) consistently fails with EINVAL
instead of mapping the sound buffer memory into userspace. It took me a while
to figure out a pattern until I found the culprit.

What happens:
 1) Application does a ioctl(2) query of the dsp sound buffer size
(SNDCTL_DSP_GETISPACE or SNDCTL_DSP_GETOSPACE).
 2) Application requests to mmap(2) the dsp buffer of that size.
 3) The requested memory map length is rounded to page size (vm_mmap() in
sys/vm/vm_mmap.c).
 4) The device checks that the requested length does not exceed its buffer size
(dsp_mmap_single() in sys/dev/sound/pcm/dsp.c).

Now because of the rounding in 3), 4) will always fail if the buffer size is
not a multiple of the page size. This primarily affects dsp devices with a
non-power-of-two number of channels, 24bit sample size, or low-latency sound
buffers smaller than one page.

I was able to reproduce the problem with multiple sound card setups on both
13.1-RELEASE and 14.0-CURRENT.

Proposed fix (see patch attached):
Let the device check the requested length against the allocation size of the
buffer, which is always whole pages. This still prevents mapping pages which do
not belong to the dsp buffer allocation, but works fine with the rounding in
3).
Even though the application may now map more than the actual sound buffer (but
no more than allocated by the dsp), the additional parts are effectively
unused.

This fix was tested with multiple sound card setups on 14.0-CURRENT.

-- 
You are receiving this mail because:
You are the assignee for the bug.